Summary
Yamcs has Unauthenticated Directory Traversal
Advisory details
Attack type:
Unauthenticated remote
Impact:
Attackers can access any system files from the underlying host.
Affected components: HttpRequestHandler.java, StaticFileHandler.java
An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.
Steps to Reproduce:
- Start Yamcs and login as a user
- Paste the following URL in the browser and press enter:
http://localhost:8090//etc/passwd
- The
/etc/passwdfile will be downloaded.
Acknowledgements
This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.
References
- https://github.com/advisories/GHSA-9jg3-g3wh-w9pj
- https://github.com/yamcs/yamcs/security/advisories/GHSA-9jg3-g3wh-w9pj
- https://github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4
- https://github.com/yamcs/yamcs/commit/f4bc588880c166849e983aa8f65b9c8107d06091
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.11.13
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.0
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-75859
CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
- HIGHCVE-2026-75914
CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
- HIGHCVE-2026-69086
SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure
- MEDIUMCVE-2026-61625
VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root
- MEDIUMCVE-2026-75602
OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool
- MEDIUMGHSA-gw25-m53r-qh88
SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)