fkie_cve-2026-55552

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.

GHSA-9jg3-g3wh-w9pj — Yamcs has Unauthenticated Directory Traversal

Affected: Maven: org.yamcs:yamcs-core

### Attack type:  Unauthenticated remote

### Impact: Attackers can access any system files from the underlying host.

### Affected components: HttpRequestHandler.java, StaticFileHandler.java

An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.

## Steps to Reproduce: 1. Start Yamcs and login as a user 2. Paste the following URL in the browser and press enter:

``` http://localhost:8090//etc/passwd ```

3. The `/etc/passwd` file will be downloaded.

## Acknowledgements This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.

Most recent entries from all

fkie_cve-2026-55552

GHSA-9jg3-g3wh-w9pj — Yamcs has Unauthenticated Directory Traversal