CVE-2026-55552: Yamcs has Unauthenticated Directory Traversal
Attack type:
Unauthenticated remote
Impact:
Attackers can access any system files from the underlying host.
Affected components: HttpRequestHandler.java, StaticFileHandler.java
An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.
Steps to Reproduce:
- Start Yamcs and login as a user
- Paste the following URL in the browser and press enter:
http://localhost:8090//etc/passwd
- The
/etc/passwdfile will be downloaded.
Acknowledgements
This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.
References
- github.com/advisories/GHSA-9jg3-g3wh-w9pj
- github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4
- github.com/yamcs/yamcs/commit/f4bc588880c166849e983aa8f65b9c8107d06091
- github.com/yamcs/yamcs/releases/tag/yamcs-5.11.13
- github.com/yamcs/yamcs/releases/tag/yamcs-5.12.0
- github.com/yamcs/yamcs/security/advisories/GHSA-9jg3-g3wh-w9pj
- nvd.nist.gov/vuln/detail/CVE-2026-55552
Code Behaviors & Features
Detect and mitigate CVE-2026-55552 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →