CVE-2026-75337
Received Received - Intake

Path Traversal Vulnerability in Yu AI Code Mother

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: MITRE

Description
The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-75337
EUVD
EUVD-2026-67327

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
yu_ai_code_mother yu_ai_code_mother 3.5.3
embedded_tomcat embedded_tomcat 10.1
yu_ai_code_mother yu_ai_code_mother 4.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75337 is a path traversal vulnerability in Yu AI Code Mother v4.3. The issue is in the /api/static/{deployKey}/ endpoint where user-controlled paths are directly concatenated to the preview root directory without normalization. This allows attackers to read files outside the intended directory by using inputs like ../../secret.properties.

Detection Guidance

To detect this vulnerability, check if your system exposes the /api/static/{deployKey}/ endpoint. Use curl to test path traversal by requesting files outside the preview root, e.g., curl http://<target>/api/static/test_deploy/../../secret.properties. If the server returns sensitive files, the vulnerability exists.

Impact Analysis

This vulnerability allows unauthorized access to sensitive files on the server. Attackers can read files outside the preview root directory, including application temporary files or configuration files. No authentication is required, making it easy to exploit remotely.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA, which mandate strict access controls and protection of sensitive data. Unauthorized file access could lead to data breaches, resulting in legal penalties and reputational damage.

Mitigation Strategies

Immediately update to a patched version of Yu AI Code Mother. If unavailable, restrict access to the /api/static/{deployKey}/ endpoint via firewall rules or disable it. Ensure proper input validation and normalization for user-controlled paths in the StaticResourceController.java file.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75337. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart