Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ageerle/ruoyi-ai

              main @ 7aa67cf
            

Fixes

CVEs

HIGH

Peak severity

83.3%

Coverage

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

TableSchemaManager.java: most-fixed (1 issue). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Missing authorization checks on administrative operations allow remote attackers to perform unauthorized actions such as editing or listing notices. This is confirmed by CVE-2025-3202 and patched by enforcing explicit permission checks.

Unrestricted File Upload: Missing extension validation during multipart-to-file conversions permits remote attackers to upload arbitrary malicious files via vulnerable endpoints like speechToTextTranscriptionsV2.

Auth Bypass: Flawed URL path pattern matching allows unauthenticated users to completely bypass global security filters and access protected system APIs.