CVE-2026-4564: yangzongzhuan RuoYi Quartz Job job code injection

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-23 · updated 2026-06-17
Weakness: CWE-74

Description

A security vulnerability has been detected in yangzongzhuan RuoYi up to 4.8.2. This issue affects some unknown processing of the file /monitor/job/ of the component Quartz Job Handler. Such manipulation of the argument invokeTarget leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

yangzongzhuan RuoYi: 4.8.0, 4.8.1, 4.8.2

References

https://github.com/M0onc/RuoYi-Quartz-RCE
https://vuldb.com/?ctiid.352401
https://vuldb.com/?id.352401
https://vuldb.com/?submit.775116

Get alerted when CVE-2026-4564 or the next vulnerability affects your stack