{"id":"CVE-2026-55552","aliases":["GHSA-9jg3-g3wh-w9pj"],"url":"https://o3.security/vulnerability/CVE-2026-55552","summary":"Yamcs: Unauthenticated Directory Traversal","details":"### Attack type: \nUnauthenticated remote  \n\n### Impact: \nAttackers can access any system files from the underlying host.\n\n### Affected components: HttpRequestHandler.java, StaticFileHandler.java\n\nAn Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.\n\n<img width=\"2170\" height=\"1289\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8d426da1-5351-4240-a290-8d858be61312\" />\n\n## Steps to Reproduce:\n1. Start Yamcs and login as a user\n2. Paste the following URL in the browser and press enter:\n\n```\nhttp://localhost:8090//etc/passwd\n```\n\n3. The `/etc/passwd` file will be downloaded.\n\n## Acknowledgements\nThis vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.","published":"2026-08-28T17:18:45.617Z","modified":"2026-09-10T08:13:52.292895Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00428,"percentile":0.3642,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.yamcs:yamcs-core","fixedVersion":"5.12.0"}],"fix":{"url":"https://github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4","label":"yamcs/yamcs@c7dfd24"},"references":[{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.11.13"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55552.json"},{"type":"ADVISORY","url":"https://github.com/yamcs/yamcs/security/advisories/GHSA-9jg3-g3wh-w9pj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55552"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/f4bc588880c166849e983aa8f65b9c8107d06091"},{"type":"PACKAGE","url":"https://github.com/yamcs/yamcs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T08:13:52.292895Z"}}