-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies uploadFilesPath as the vulnerable function handling file uploads. The XSS occurs because user-controlled originalFilenames parameter values are rendered in the UI without proper sanitization. This matches the CWE-79 pattern of improper input neutralization during web page generation. The Gitee issue discussion about filename reflection confirms the attack vector. While exact line numbers aren't available, the component context (File Upload) and parameter name (originalFilenames) strongly indicate insecure handling of user-controlled filename values in this controller method.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.ruoyi:ruoyi | maven | <= 4.7.7 |
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report