CVE-2026-110116

Deferred Deferred - Pending Action

Path Traversal in Risesoft-y9 Digital-Infrastructure

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or overwrite service-writable files, potentially achieving code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110116

EUVD

EUVD-2026-98947

Affected Vendors & Products

Vendor	Product	Version / Range
risesoft-y9	Digital-Infrastructure	9.6.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in Risesoft-y9 Digital-Infrastructure versions 9.6.5 through 9.6.11. It allows unauthenticated attackers to write arbitrary files by exploiting the fileManager storeFile endpoint. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or overwrite service-writable files, which could lead to code execution.

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /rest/storeFile with parameters fullPath and fileName. Check for unusual file writes in service-writable directories. Use tools like curl to test if the endpoint is accessible and vulnerable.

Impact Analysis

This vulnerability can allow attackers to write arbitrary files on the affected system. This could lead to unauthorized code execution, data manipulation, or system compromise. Attackers might gain control over the system, steal sensitive data, or disrupt services.

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access, or data integrity issues, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using the affected software may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately update Risesoft-y9 Digital-Infrastructure to a patched version. If an update is unavailable, restrict access to /rest/storeFile via firewall rules or disable the endpoint. Monitor for unauthorized file writes and remove suspicious files.

Hi! I’m here to help you understand CVE-2026-110116. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70