CVE-2026-75337

Deferred Deferred - Pending Action

Path Traversal Vulnerability in Yu AI Code Mother

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: MITRE

Description

The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-75337

EUVD

EUVD-2026-67327

Affected Vendors & Products

Vendor	Product	Version / Range
yu_ai_code_mother	yu_ai_code_mother	3.5.3
embedded_tomcat	embedded_tomcat	10.1
yu_ai_code_mother	yu_ai_code_mother	4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-75337 is a path traversal vulnerability in Yu AI Code Mother v4.3. The issue is in the /api/static/{deployKey}/ endpoint where user-controlled paths are directly concatenated to the preview root directory without normalization. This allows attackers to read files outside the intended directory by using inputs like ../../secret.properties.

Detection Guidance

To detect this vulnerability, check if your system exposes the /api/static/{deployKey}/ endpoint. Use curl to test path traversal by requesting files outside the preview root, e.g., curl http://<target>/api/static/test_deploy/../../secret.properties. If the server returns sensitive files, the vulnerability exists.

Impact Analysis

This vulnerability allows unauthorized access to sensitive files on the server. Attackers can read files outside the preview root directory, including application temporary files or configuration files. No authentication is required, making it easy to exploit remotely.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA, which mandate strict access controls and protection of sensitive data. Unauthorized file access could lead to data breaches, resulting in legal penalties and reputational damage.

Mitigation Strategies

Immediately update to a patched version of Yu AI Code Mother. If unavailable, restrict access to the /api/static/{deployKey}/ endpoint via firewall rules or disable it. Ensure proper input validation and normalization for user-controlled paths in the StaticResourceController.java file.

Hi! I’m here to help you understand CVE-2026-75337. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70