What is the CVSS score of CVE-2026-55552?

CVE-2026-55552 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Yamcs are affected by CVE-2026-55552?

Yamcs mission planning software versions before 5.11.13 are vulnerable to unauthenticated remote file access that could expose sensitive mission data, system credentials, and operational…. A patch is available.

How to fix or mitigate CVE-2026-55552?

Within 24 hours, inventory all Yamcs installations and identify versions prior to 5.11.13 that are vulnerable per the vendor advisory. Within 7 days, upgrade all affected instances to Yamcs 5.11.13 or later; meanwhile, restrict network access to these systems via firewall rules to trusted administrative networks only. Within 30 days, audit system logs for evidence of exploitation attempts during the exposure window and confirm all systems are running the patched version.

Yamcs CVE-2026-55552

EUVD-2026-67842 HIGH

Path Traversal (CWE-22)

2026-08-28 https://github.com/yamcs/yamcs

GHSA-9jg3-g3wh-w9pj

Path Traversal Java

7.5

CVSS 3.1 · Vendor: https://github.com/yamcs/yamcs

Severity by source

Vendor (https://github.com/yamcs/yamcs) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable HTTP endpoint, trivial single-request exploit, no authentication; confidentiality-only impact as traversal enables read but not write.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/yamcs/yamcs).

CVSS VectorVendor: https://github.com/yamcs/yamcs

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 28, 2026 - 18:02 vuln.today

Analysis Generated

Aug 28, 2026 - 18:02 vuln.today

CVE Published

Aug 28, 2026 - 17:20 github-advisory

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.yamcs:yamcs-core (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.12.0.

DescriptionCVE.org

Attack type:

Unauthenticated remote

Impact:

Attackers can access any system files from the underlying host.

Affected components: HttpRequestHandler.java, StaticFileHandler.java

An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.

Steps to Reproduce:

Start Yamcs and login as a user
Paste the following URL in the browser and press enter:

http://localhost:8090//etc/passwd

The /etc/passwd file will be downloaded.

Acknowledgements

This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.

AnalysisAI

Unauthenticated directory traversal in Yamcs versions up to and including 5.8.6 (per advisory scope, < 5.11.13 per package metadata) allows any remote attacker to read arbitrary files from the underlying host operating system by sending a crafted HTTP request. The flaw resides in StaticFileHandler.java, which resolves user-supplied URL paths against a static file root without verifying the resolved path stays within that root - a double-slash prefix (e.g., //etc/passwd) is sufficient to escape the boundary. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special configuration is required - the vulnerability exists in the default HTTP static file serving path of any Yamcs instance. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects the severity: the attack requires only network access to the Yamcs HTTP port, no authentication, no user interaction, and a trivially crafted URL. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade org.yamcs:yamcs-core to version 5.11.13 or 5.12.0, both available at https://github.com/yamcs/yamcs/releases/tag/yamcs-5.11.13 and https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.0 respectively. … Detailed patch versions, workarounds, and compensating controls in full report.