CVE-2025-66916
Last modified
CVE-2025-66916 is a critical-severity vulnerability rated 9.4/10 on the CVSS scale. The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing.. EPSS estimates a 0.63% chance of exploitation in the next 30 days.
Description
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dromara | Ruoyi-Vue-Plus | <= 5.5.1 |
References
- https://gist.github.com/Catherines77/e3f06b9c4cc6298579e858088a243c3dThird Party Advisory
- https://github.com/Catherines77/code-au/blob/main/ruoyi-vue-plus/QLExpress.mdExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-66916?
How severe is CVE-2025-66916?
How do I fix CVE-2025-66916?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-66908Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contain…5.3
- CVE-2025-66909Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contain…7.5
- CVE-2025-6691The SureForms – Drag and Drop Form Builder for WordPress plu…8.1
- CVE-2025-66910Turms Server v0.10.0-SNAPSHOT and earlier contains a plainte…6
- CVE-2025-66911Turms IM Server v0.10.0-SNAPSHOT and earlier contains a brok…6.5
- CVE-2025-66913JimuReport thru version 2.1.3 is vulnerable to remote code e…9.8
- CVE-2025-66918edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross…8.8
- CVE-2025-6692The YouTube Embed plugin for WordPress is vulnerable to Stor…6.4
- CVE-2025-66921A Cross-site scripting (XSS) vulnerability in Create/Update …7.2
- CVE-2025-66923A Cross-site scripting (XSS) vulnerability in Create/Update …7.2
- CVE-2025-66924A Cross-site scripting (XSS) vulnerability in Create/Update …6.1
- CVE-2025-6693A vulnerability, which was classified as critical, was found…8.5
Are you affected by CVE-2025-66916?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST