RiseSoft-y9 Unauthenticated Path Traversal in Y9FileManager (CVE-2026-11015/11016)

CVE-2026-11015, CVE-2026-11016: risesoft-y9 Digital-Infrastructure file manager: unauthenticated path traversal in retrieveFileStream and storeFile for arbitrary file read and write Vulnerability Overview Vulnerability Type: Path Traversal Affected Components: and Severity: High Status: Coordinated disclosure in progress; CVE IDs have not yet been assigned. Detailed Description Description: The file manager microservice in contains a controller named . Its request handlers construct filesystem paths by concatenating a configured root directory with two request parameters, and , and then read from or write to that path without normalization or content validation. The previously known CVE-2025-7108 only covers the handler. This controller has two sibling handlers whose normalization logic differs from the existing CVE: - returns the parsed file stream to the caller, allowing arbitrary file reading. - writes uploaded multipart bodies to the parsed path after creating any missing parent directories, allowing arbitrary file writing. Root Causes: 1. Configured root directory is used with direct string concatenation. 2. serves as the endpoint for arbitrary file reading. 3. serves as the endpoint for arbitrary file writing. 4. The same vulnerability pattern was present in a third handler, which already has an assigned CVE. 5. The microservice lacks authentication mechanisms. Impact Scope Affected Versions: Confirmed present in version (commit ) and the latest tag (commit ). Both endpoints are byte-identical across both versions. Impact: Unauthenticated callers can read any file that the service process has permission to open, including application configurations holding credentials for databases, Redis, and Nacos. They can also write to any path, potentially leading to code execution if the written file is located in a directory served or executed by the server at a later time. Remediation Current Status: Coordinated disclosure in progress; CVE IDs have not yet been assigned. Recommendation: Wait for the official release of a patched version and monitor for relevant security advisories. Attack Flow Attack Steps: 1. Service Discovery: Identify the host and port hosting the context path. 2. Arbitrary File Read: Send a GET request to , setting to a value that traverses out of the configured root directory into the target directory, and to the target filename. 3. Arbitrary File Write: Send a multipart POST request to , including a parameter containing the content to write. Set to resolve to the chosen destination directory and to the name of the file being written. 4. State Change: After Step 2, the attacker holds the content of files at a path of their choosing. When this path corresponds to a directory, the application serves the content as static content or executes it, resulting in code execution. Validation Verification Method: This finding was confirmed through static source code review. No repositories were cloned or downloaded to the local machine, target code was not executed, no proof-of-concept was run against a live deployment, and no contact was made with the live system. Runtime validation was not performed; therefore, the practical results of the write primitive are inferred from the source code and module configuration and have not been directly observed. Reference Code retrieveFileStream Handler storeFile Handler deleteFile Handler (Existing CVE-2025-7108) Dependency Configuration Application Class Configuration File Request Examples Arbitrary File Read Arbitrary File Write

Goal Reached Thanks to every supporter — we hit 100%!

RiseSoft-y9 Unauthenticated Path Traversal in Y9FileManager (CVE-2026-11015/11016)

More from this source