CVE-2026-55552

Received Received - Intake

Path Traversal Vulnerability in Yamcs Mission Control Framework

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55552

EUVD

EUVD-2026-67842

Affected Vendors & Products

Vendor	Product	Version / Range
yamcs	yamcs	to 5.11.13 (exc)
yamcs	yamcs	5.12.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-55552 is an unauthenticated directory traversal vulnerability in Yamcs versions 5.12.0 and earlier. It exists in the StaticFileHandler component where unauthenticated requests can exploit improper pathname restrictions to access arbitrary files on the host system. The flaw allows attackers to traverse outside the intended web root and read sensitive files like /etc/passwd using specially crafted URLs.

Detection Guidance

To detect this vulnerability, check if your Yamcs instance is running a version prior to 5.11.13 or 5.12.0. Use commands like 'yamcs --version' or inspect the version in your deployment logs. Test for directory traversal by attempting to access sensitive files via crafted URLs, such as '/../../../../etc/passwd'.

Impact Analysis

This vulnerability allows unauthenticated attackers to read sensitive files on the server hosting Yamcs. Attackers could access configuration files, credentials, system files, or other confidential data. The impact includes potential data breaches, unauthorized information disclosure, and compromise of the underlying system depending on the files accessed.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to personal or sensitive data. Organizations using vulnerable Yamcs versions may face violations for failing to protect personal data, potential data breach notifications, and regulatory penalties depending on the data exposed.

Mitigation Strategies

Upgrade Yamcs to version 5.11.13 or 5.12.0 immediately. If upgrading is not possible, restrict network access to Yamcs instances and monitor for unusual file access patterns. Review and apply the security patches from the GitHub commits f4bc588 or c7dfd24.

Hi! I’m here to help you understand CVE-2026-55552. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70