GHSA-9JG3-G3WH-W9PJ高危已审查

Yamcs has Unauthenticated Directory Traversal

OSV 1.4.0 · github-reviewed · 修改于 2026-08-29 01:20

发布时间

2026-08-29 01:20

GitHub 审查时间

2026-08-29 01:20

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/08/GHSA-9jg3-g3wh-w9pj/GHSA-9jg3-g3wh-w9pj.json

公告说明

Attack type: 

Unauthenticated remote 

Impact:

Attackers can access any system files from the underlying host.

Affected components: HttpRequestHandler.java, StaticFileHandler.java

An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.

Steps to Reproduce:

Start Yamcs and login as a user
Paste the following URL in the browser and press enter:

http://localhost:8090//etc/passwd

The /etc/passwd file will be downloaded.

Acknowledgements

This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.

受影响的软件包

Maven

标识信息

别名 / CVE

CVE-2026-55552

CWE

CWE-22

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-9jg3-g3wh-w9pj",
  "aliases": [
    "CVE-2026-55552"
  ],
  "details": "### Attack type: \nUnauthenticated remote  \n\n### Impact: \nAttackers can access any system files from the underlying host.\n\n### Affected components: HttpRequestHandler.java, StaticFileHandler.java\n\nAn Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.\n\n<img width=\"2170\" height=\"1289\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8d426da1-5351-4240-a290-8d858be61312\" />\n\n## Steps to Reproduce:\n1. Start Yamcs and login as a user\n2. Paste the following URL in the browser and press enter:\n\n```\nhttp://localhost:8090//etc/passwd\n```\n\n3. The `/etc/passwd` file will be downloaded.\n\n## Acknowledgements\nThis vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.",
  "summary": "Yamcs has Unauthenticated Directory Traversal",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.12.0"
            }
          ]
        }
      ],
      "package": {
        "name": "org.yamcs:yamcs-core",
        "ecosystem": "Maven"
      },
      "database_specific": {
        "last_known_affected_version_range": "< 5.11.13"
      }
    }
  ],
  "modified": "2026-08-28T17:20:42Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2026-08-28T17:20:42Z",
  "references": [
    {
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-9jg3-g3wh-w9pj",
      "type": "WEB"
    },
    {
      "url": "https://github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4",
      "type": "WEB"
    },
    {
      "url": "https://github.com/yamcs/yamcs/commit/f4bc588880c166849e983aa8f65b9c8107d06091",
      "type": "WEB"
    },
    {
      "url": "https://github.com/yamcs/yamcs",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.11.13",
      "type": "WEB"
    },
    {
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.0",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-08-28T17:20:42Z"
  }
}