High severity · published Apr 2, 2023
CVE-2023-27025
An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
Ruoyi · Ruoyi
through 4.7.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-27025
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-27025
Permissions Required
https://gitee.com/y_project/RuoYi/commit/432d5ce1be2e9384a6230d7ccd8401eef5ce02b0
Exploit
https://gitee.com/y_project/RuoYi/issues/I697Q5
More from Ruoyi
10.0
CVE-2024-57521
SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java
9.8
CVE-2025-10473
yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection
9.8
CVE-2025-28402
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter
9.8
CVE-2025-28405
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method
9.8
CVE-2025-28413
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component