CVE-2026-110115 Details

A path traversal vulnerability has been identified in the Risesoft Digital-Infrastructure file manager component, specifically in versions 9.6.5 through 9.6.11. The vulnerability resides in the Y9FileController's retrieveFileStream handler, where unauthenticated attackers can exploit parent-directory segments in the fullPath and fileName parameters to access arbitrary files. The issue is exacerbated by the absence of authentication in the microservice, allowing any client to reach the vulnerable endpoints. Exploitation of this vulnerability can lead to unauthorized access to sensitive files, such as the application.yml configuration, which contains critical database, Redis, and Nacos credentials.

The vulnerability can be addressed by implementing a canonicalization check for the file paths in the affected controller methods, ensuring that no traversal is allowed outside the designated root directory. Additionally, the file manager service should be secured with authentication and not exposed to untrusted callers.