Digital-Infrastructure vulnerabilities
CVEs whose affected-version data names the Digital-Infrastructure package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-111651Medium· 6.5Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController
Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another t…
CVE-2026-110116Critical· 9.1Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files
Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and…
CVE-2026-110115High· 7.5Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent…
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent…