CVE-2026-55552: Yamcs: Unauthenticated Directory Traversal
Attack type: Unauthenticated remote
Impact: Attackers can access any system files from the underlying host.
Affected components: HttpRequestHandler.java, StaticFileHandler.java
An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.
<img width="2170" height="1289" alt="image" src="https://github.com/user-attachments/assets/8d426da1-5351-4240-a290-8d858be61312" />
Steps to Reproduce: 1. Start Yamcs and login as a user 2. Paste the following URL in the browser and press enter:
http://localhost:8090//etc/passwd
3. The /etc/passwd file will be downloaded.
Acknowledgements This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.
Other sources
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.yamcs:yamcs-coreto a version that resolves this vulnerability.Fixed in 5.12.0 - Upgrade
Upgrade
Yamcsto a version that resolves this vulnerability.Fixed in 5.11.13 - Upgrade
Upgrade
Yamcsto a version that resolves this vulnerability.Fixed in 5.12.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Yamcs versions 5.8.6 and earlier are affected. The vulnerable request handling involves HttpRequestHandler.java and StaticFileHandler.java.
Does exploitation require authentication or user interaction?
No. An unauthenticated remote attacker can exploit the issue without privileges or user interaction.
What access can an attacker gain?
An attacker can download arbitrary files from the underlying host operating system, including sensitive system files and data.
How can I verify that a deployment is vulnerable?
The provided reproduction accesses /etc/passwd through a Yamcs endpoint using a double-slash path, such as http://localhost:8090//etc/passwd. If the file is downloaded, the instance is vulnerable.