요약
- CVE-2026-55552은(는) org.yamcs:yamcs-core에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 1.7%, 전체 취약점의 77.5%보다 높음.
- 조치: 5.12.0 이상으로 업데이트하세요.
Description
Attack type:
Unauthenticated remote
Impact:
Attackers can access any system files from the underlying host.
Affected components: HttpRequestHandler.java, StaticFileHandler.java
An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.
<img width="2170" height="1289" alt="image" src="https://github.com/user-attachments/assets/8d426da1-5351-4240-a290-8d858be61312" />
Steps to Reproduce:
- Start Yamcs and login as a user
- Paste the following URL in the browser and press enter:
http://localhost:8090//etc/passwd
- The
/etc/passwd file will be downloaded.
Acknowledgements
This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.
NVD description
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.
org.yamcs:yamcs-core의 다른 취약점
모두 보기 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free