En bref
- CVE-2026-55552 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant org.yamcs:yamcs-core.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.7%, plus élevée que 77.5% des vulnérabilités.
- Correctif : mettre à jour vers 5.12.0 ou plus récent.
Description
Attack type:
Unauthenticated remote
Impact:
Attackers can access any system files from the underlying host.
Affected components: HttpRequestHandler.java, StaticFileHandler.java
An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.
<img width="2170" height="1289" alt="image" src="https://github.com/user-attachments/assets/8d426da1-5351-4240-a290-8d858be61312" />
Steps to Reproduce:
- Start Yamcs and login as a user
- Paste the following URL in the browser and press enter:
http://localhost:8090//etc/passwd
- The
/etc/passwd file will be downloaded.
Acknowledgements
This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.
NVD description
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.
Autres vulnérabilités de org.yamcs:yamcs-core
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free