CVE-2026-110115

Deferred Deferred - Pending Action

Path Traversal in Risesoft Digital-Infrastructure

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110115

EUVD

EUVD-2026-98946

Affected Vendors & Products

Vendor	Product	Version / Range
risesoft-y9	Digital-Infrastructure	9.6.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in Risesoft Digital-Infrastructure versions 9.6.5 through 9.6.11. It allows unauthenticated attackers to read arbitrary files by manipulating the fullPath and fileName parameters in the fileManager Y9FileController.retrieveFileStream handler. Attackers can access sensitive files like application.yml by targeting the /rest/retrieveFileStream endpoint.

Detection Guidance

To detect this vulnerability, check if the /rest/retrieveFileStream endpoint is accessible without authentication. Use curl to test: curl -v http://<target>/rest/retrieveFileStream?fullPath=../../../../etc/passwd&fileName=test. If the response includes file contents, the system is vulnerable.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files, including configuration files that may contain database, Redis, and Nacos credentials. Attackers could exploit this to gain access to critical system information, potentially leading to further compromise of the system or data breaches.

Compliance Impact

The vulnerability allows unauthenticated attackers to read arbitrary files, including sensitive configuration files like application.yml. This could expose credentials for databases, Redis, and Nacos, leading to unauthorized access to personal data. Such exposure risks violating GDPR's data protection principles and HIPAA's safeguards for protected health information by enabling unauthorized data access or breaches.

Mitigation Strategies

Immediately update Risesoft Digital-Infrastructure to a patched version. If an update is unavailable, restrict access to the /rest/retrieveFileStream endpoint via firewall rules or disable it if not needed. Monitor logs for unauthorized file access attempts.

Hi! I’m here to help you understand CVE-2026-110115. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70