CVE-2026-55552High· 7.5▾ TwilightYamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.yamcs:yamcs-core < 5.11.13Patched in:
org.yamcs:yamcs-core 5.12.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55559Critical· 9.8Yamcs is a mission control framework
CVE-2026-55565Critical· 9.9Yamcs is a mission control framework
CVE-2026-55566Medium· 4.3Yamcs is a mission control framework
CVE-2026-55511Critical· 9.1Yamcs is a mission control framework
CVE-2026-55521High· 8.8Yamcs is a mission control framework
CVE-2026-55545Medium· 6.5Yamcs is a mission control framework