CVE-2026-55552 json
Yamcs: Unauthenticated Directory Traversal
published 2mo ago modified 2mo ago also EUVD-2026-67842 , GHSA-9jg3-g3wh-w9pj
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.
Patch / fix
- maven org.yamcs:yamcs-core 5.12.0
- org.yamcs yamcs-core 5.12.0
- spaceapplications yamcs 5.12.0
Is CVE-2026-55552 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
1.72% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.yamcs:yamcs-core | <5.12.0 |
5.12.0 |
Affected products
- yamcs yamcs
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4
web
-
github.com
/yamcs/yamcs/commit/f4bc588880c166849e983aa8f65b9c8107d06091
web
-
github.com
/yamcs/yamcs/security/advisories/GHSA-9jg3-g3wh-w9pj
web
-
github.com
/yamcs/yamcs/releases/tag/yamcs-5.11.13
web
-
github.com
/yamcs/yamcs/releases/tag/yamcs-5.12.0
web
-
github.com
/yamcs/yamcs
package
Sources
- CVE List CVE-2026-55552
- GitHub Advisory GHSA-9jg3-g3wh-w9pj
- NVD CVE-2026-55552
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.