CVE-2026-129247

CVSS 5.1 (medium) · published 2026-11-14

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.3. Impacted is the function VelocityUtils.getFileName of the file VelocityUtils.java of the component Code Generator. Performing a manipulation of the argument className results in path traversal. The attack is possible to be carried out remotely.

Weakness: CWE-22

Source: NVD CVE-2026-129247

References

• https://vuldb.com/cve/CVE-2026-129247
• https://vuldb.com/submit/1042438
• https://vuldb.com/vuln/437278
• https://vuldb.com/vuln/437278/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.