CVE-2026-55552: Yamcs has Unauthenticated Directory Traversal
Attack type:
Unauthenticated remote
Impact:
Attackers can access any system files from the underlying host.
Affected components: HttpRequestHandler.java, StaticFileHandler.java
An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.
Steps to Reproduce:
- Start Yamcs and login as a user
- Paste the following URL in the browser and press enter:
http://localhost:8090//etc/passwd
- The
/etc/passwdfile will be downloaded.
Acknowledgements
This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.
References
- github.com/advisories/GHSA-9jg3-g3wh-w9pj
- github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4
- github.com/yamcs/yamcs/commit/f4bc588880c166849e983aa8f65b9c8107d06091
- github.com/yamcs/yamcs/releases/tag/yamcs-5.11.13
- github.com/yamcs/yamcs/releases/tag/yamcs-5.12.0
- github.com/yamcs/yamcs/security/advisories/GHSA-9jg3-g3wh-w9pj
- nvd.nist.gov/vuln/detail/CVE-2026-55552
Code Behaviors & Features
Detect and mitigate CVE-2026-55552 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →