要点
- CVE-2026-55552 是影响 org.yamcs:yamcs-core 的高危 (CVSS 7.5)漏洞。
- 未来 30 天内被利用的概率（EPSS）：1.7%，高于 77.5% 的漏洞。
- 修复：升级到 5.12.0 或更高版本。
Description
Attack type:
Unauthenticated remote
Impact:
Attackers can access any system files from the underlying host.
Affected components: HttpRequestHandler.java, StaticFileHandler.java
An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.
<img width="2170" height="1289" alt="image" src="https://github.com/user-attachments/assets/8d426da1-5351-4240-a290-8d858be61312" />
Steps to Reproduce:
- Start Yamcs and login as a user
- Paste the following URL in the browser and press enter:
http://localhost:8090//etc/passwd
- The
/etc/passwd file will be downloaded.
Acknowledgements
This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.
NVD description
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.
org.yamcs:yamcs-core 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free