{"id":"CVE-2026-55552","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-55552","summary":"Yamcs has Unauthenticated Directory Traversal","details":"### Attack type: \nUnauthenticated remote  \n\n### Impact: \nAttackers can access any system files from the underlying host.\n\n### Affected components: HttpRequestHandler.java, StaticFileHandler.java\n\nAn Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.\n\n<img width=\"2170\" height=\"1289\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8d426da1-5351-4240-a290-8d858be61312\" />\n\n## Steps to Reproduce:\n1. Start Yamcs and login as a user\n2. Paste the following URL in the browser and press enter:\n\n```\nhttp://localhost:8090//etc/passwd\n```\n\n3. The `/etc/passwd` file will be downloaded.\n\n## Acknowledgements\nThis vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.","published":"2026-08-28T17:20:42Z","modified":"2026-08-28T17:30:07.726009579Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.yamcs:yamcs-core","fixedVersion":"5.12.0"}],"fix":{"url":"https://github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4","label":"yamcs/yamcs@c7dfd24"},"references":[{"type":"WEB","url":"https://github.com/yamcs/yamcs/security/advisories/GHSA-9jg3-g3wh-w9pj"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/commit/f4bc588880c166849e983aa8f65b9c8107d06091"},{"type":"PACKAGE","url":"https://github.com/yamcs/yamcs"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.11.13"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-28T17:30:07.726009579Z"}}