Risesoft Digital-Infrastructure CVE-2026-110115

No special conditions beyond network reachability - the /rest/retrieveFileStream endpoint is unauthenticated by design, so exploitation requires only that the Risesoft Digital-Infrastructure fileManager module (versions 9.6.5-9.6.11) be network-accessible to the attacker. The concrete prerequisite is the presence of the vulnerable Y9FileController.retrieveFileStream handler, reached by placing parent-directory ('../') segments in the fullPath and fileName parameters. The primary limiting factor is exposure: impact is confined to reading files readable by the application's service account (confidentiality only - no write or code execution), and real-world risk depends on the instance being reachable from an untrusted network and on sensitive files like application.yml residing within traversable reach.

This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the description corroborates every one of those metrics - the /rest/retrieveFileStream endpoint is explicitly unauthenticated and exploited via crafted parameters, so the vector and the prose agree (no AV:N-vs-local-access conflict here). Impact is confidentiality-only (VC:H/VI:N/VA:N), consistent with an arbitrary-file-read primitive rather than code execution, which is why the base score is 8.7 (High) rather than Critical. The real-world severity is amplified by what the file read yields: the advisory notes application.yml discloses database, Redis and Nacos credentials, turning a read primitive into a credible stepping stone toward fuller compromise of backend services. No CISA KEV listing and no EPSS score were provided in the input, so exploitation likelihood cannot be quantified from these sources; however, a published VulnCheck advisory and a public HackMD technical write-up exist, lowering the barrier to weaponization. Net: treat as a priority patch for any exposed instance, while recognizing active-exploitation and probability signals (KEV/EPSS) are simply absent rather than reassuringly low.

An unauthenticated attacker sends an HTTP request to the exposed /rest/retrieveFileStream endpoint with parent-directory sequences in the fullPath and fileName parameters to escape the intended file directory. They retrieve application.yml and harvest the embedded database, Redis, and Nacos credentials, which can then be used to pivot into those backend services. Public technical write-ups (HackMD, VulnCheck advisory) describe the flaw in detail, though no packaged exploit tool is identified in the provided data.