CVE-2025-66916
CriticalSummary
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing.
Risk Assessment
The risk includes the ability to read and write arbitrary files on the server, which can lead to data confidentiality breaches, system modification, or further privilege escalation.
Recommendation
It is recommended to immediately upgrade RuoYi-Vue-Plus to a version later than 5.5.1 and implement input filtering on the check-node-expression interface.
Original NVD description (English source)
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing.