Yamcs EUVD-2026-67842

No special configuration is required - the vulnerability exists in the default HTTP static file serving path of any Yamcs instance. The only prerequisite is network reachability to the Yamcs HTTP port (default TCP 8090); no authentication, session, or specific feature enablement is needed. Exploitation is limited by: (1) the Yamcs server must be network-accessible from the attacker (not firewalled); (2) files readable by the OS user running the Yamcs process are the only ones accessible - files owned by other users with restrictive permissions will be inaccessible regardless of traversal; (3) the double-slash trigger must not be stripped by an intervening reverse proxy or WAF (standard nginx/Apache proxies typically normalize double slashes, which would inadvertently mitigate this). Direct-access deployments without a normalizing proxy are fully exposed.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects the severity: the attack requires only network access to the Yamcs HTTP port, no authentication, no user interaction, and a trivially crafted URL. The High confidentiality impact is well-founded - full OS file read means private keys, credentials, configuration files, and mission data are all reachable. There is no KEV listing and no known weaponized exploit at time of analysis, but the proof-of-concept technique is trivially simple (a single URL) and was published in a public CTF writeup context at DEFCON 33, meaning the barrier to exploitation is essentially zero for any attacker who reads the advisory. EPSS data was not provided in the input, so exploitation probability cannot be quantified beyond the qualitative observation that the technique is elementary. The primary risk limiter is product prevalence: Yamcs is specialist aerospace/mission-control software with a relatively narrow deployment footprint, so mass exploitation is unlikely - but any internet-exposed Yamcs instance should be treated as critically compromised until patched. The scope of readable files is bounded only by the OS file permissions of the process running Yamcs, which in many containerized or development deployments may be broad.

An unauthenticated attacker who can reach the Yamcs HTTP port (default 8090) sends a GET request with a double-slash-prefixed absolute path, such as GET //etc/passwd HTTP/1.1. The StaticFileHandler resolves this outside the static root and returns the file contents directly in the HTTP response body, allowing the attacker to iterate over sensitive paths including private keys, application credentials, and mission configuration files. Because the reproduction steps are fully published in the GitHub advisory (itself linked from a public CTF challenge), any attacker can replicate this with a single browser request or curl command.