CVE-2025-66916: Dromara Ruoyi-Vue-Plus

Critical severity, CVSS 9.4. EPSS: 0.7% chance of exploitation in the next 30 days.

The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing.

Affected products

• Dromara Ruoyi-Vue-Plus: up to and including 5.5.1

Published 2026-01-08. Last modified 2026-06-17.