Yamcs has Unauthenticated Directory Traversal
### Attack type: Unauthenticated remote ### Impact: Attackers can access any system files from the underlying host. ### Affected components: HttpRequestHandler.java, StaticFileHandler.java An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data. <img width="2170" height="1289" alt="image" src="https://github.com/user-attachments/assets/8d426da1-5351-4240-a290-8d858be61312" /> ## Steps to Reproduce: 1. Start Yamcs and login as a user 2. Paste the following URL in the browser and press enter: ``` http://localhost:8090//etc/passwd ``` 3. The `/etc/passwd` file will be downloaded. ## Acknowledgements This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-55552US | — | — | ||
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolute… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/yamcs/yamcsPACKAGE
- https://github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4WEB
- https://github.com/yamcs/yamcs/commit/f4bc588880c166849e983aa8f65b9c8107d06091WEB
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.11.13WEB
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.0WEB
- https://github.com/yamcs/yamcs/security/advisories/GHSA-9jg3-g3wh-w9pjWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan