CVE-2026-110115: Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Risesoft Digital-Infrastructure versions 9.6.5 through 9.6.11 are affected where the fileManager retrieveFileStream endpoint is reachable. The vulnerable endpoint is /rest/retrieveFileStream.
Does an attacker need credentials or user interaction?
No. Exploitation is unauthenticated and requires no user interaction; an attacker can submit parent-directory segments through the fullPath and fileName parameters.
What data could be exposed?
An attacker may read arbitrary files accessible to the application. The provided example is application.yml, which can expose database, Redis, and Nacos credentials.