CVE-2026-75337: Path Traversal
Published Aug 27, 2026
·Updated
The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root.
Affected Software
1 affected component
Yu AI Code Mother=4.3
Event History
Aug 27, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
Anonymous attackers can exploit the vulnerable static resource interface. No authentication requirement is described.
2
What access could an attacker gain?
An attacker may read files located outside the preview root directory by using path traversal in the user-controlled path.
3
Which deployment endpoint should be assessed?
Assess the static resource interface at /api/static/{deployKey}/ in Yu AI Code Mother v4.3, particularly how it handles user-supplied path components.