Risesoft-y9 Digital-Infrastructure EUVD-2026-98947

No special conditions - remote unauthenticated exploitation against default configurations of Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 via a single POST to /rest/storeFile. Exploitation requires only network reachability to the fileManager module and does not depend on authentication, user interaction, or non-default settings (AV:N/AC:L/PR:N/UI:N). What LIMITS real-world impact: achieving full code execution (versus mere file overwrite) depends on the service account's write permissions and on the attacker finding a writable path that is subsequently executed/parsed; the exposure is also bounded by whether the fileManager endpoint is reachable from the attacker's network position rather than internal-only.

This is a credible high-priority issue rather than a high-CVSS-but-low-risk paper cut. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes the most dangerous possible exposure profile: network-reachable, low-complexity, no authentication, and no user interaction, with HIGH integrity and availability impact (VC:N/VI:H/VA:H) consistent with arbitrary file write rather than data theft. The CWE-22 path traversal leading to arbitrary file write, combined with the RCE tag and the description's 'potentially achieving code execution,' means the realistic worst case is remote code execution on an unauthenticated endpoint. Tempering this: EPSS, CISA KEV, and an explicit POC flag are all ABSENT from the input, so there is no quantitative exploitation-probability signal and no confirmation of active exploitation - do NOT treat this as actively exploited. However, the disclosure includes a VulnCheck advisory, a HackMD technical writeup, and a direct link to the exact vulnerable source lines (Y9FileController.java#L168-L182), which materially lowers the barrier to weaponization even though no packaged exploit is confirmed. Net: prioritize patching on exposed instances; the low-friction attack vector offsets the product's limited deployment footprint.

An unauthenticated attacker sends a crafted POST request to /rest/storeFile with malicious fullPath and fileName parameters that traverse outside the intended upload directory. The attacker overwrites or plants a service-writable file (e.g., a web-executable or configuration/startup file) in a location that leads to code execution in the context of the file-manager service. No public exploit is confirmed, but a vendor advisory and a HackMD technical writeup describe the flaw and reference the exact vulnerable code, substantially easing exploit development.