https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T17:24:58.436103+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-55552 fkie_cve-2026-55552 2026-09-28T17:24:58.482603+00:00

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.

 https://vulnerability.circl.lu/vuln/ghsa-9jg3-g3wh-w9pj GHSA-9jg3-g3wh-w9pj — Yamcs has Unauthenticated Directory Traversal 2026-09-28T17:24:58.482716+00:00

Affected: Maven: org.yamcs:yamcs-core

### Attack type:  Unauthenticated remote

### Impact: Attackers can access any system files from the underlying host.

### Affected components: HttpRequestHandler.java, StaticFileHandler.java

An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.

<img width="2170" height="1289" alt="image" src="https://github.com/user-attachments/assets/8d426da1-5351-4240-a290-8d858be61312" />

## Steps to Reproduce: 1. Start Yamcs and login as a user 2. Paste the following URL in the browser and press enter:

``` http://localhost:8090//etc/passwd ```

3. The `/etc/passwd` file will be downloaded.

## Acknowledgements This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.