risesoft-y9 Digital-Infrastructure: Unauthenticated path traversal enabling arbitrary file read

Summary

The fileManager microservice of risesoft-y9 Digital-Infrastructure versions 9.6.5 through 9.6.11 passes the request parameters fullPath and fileName unchecked into file paths in the retrieveFileStream handler. An unauthenticated remote attacker can use parent-directory segments to read arbitrary files the service process can access. Exposed files such as application.yml can contain database, Redis and Nacos credentials. The related storeFile handler reportedly has the same defect (CVE-2026-110116).

Affected

• risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11
• Endpoint: /rest/retrieveFileStream (fileManager module)

Fixed in

Unknown. A fix commit (b9dddb7c80d15c48ba912a6454fe926d6d191830) is referenced in OSV, but no fixed release version or vendor advisory was found.

Workaround

• Block or restrict access to /rest/retrieveFileStream at the reverse proxy, WAF or firewall
• Do not expose the fileManager service to the internet
• Rotate database, Redis and Nacos credentials if exposure is suspected

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact partial
• Not listed as known exploited (KEV) in the sources checked
• A public technical write-up exists; public proof of concept unconfirmed

Our recommendation

• Determine whether any instance runs versions 9.6.5 to 9.6.11 and whether it is reachable from the internet
• Immediately block the /rest/retrieveFileStream endpoint externally and restrict internal access
• Rotate exposed credentials if the endpoint was reachable
• Review web and proxy logs for requests to this path containing '../' sequences
• Apply the vendor fix as soon as an official release is available; check for it regularly
• Also check CVE-2026-110116 (storeFile, file write)

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Vendor source code at v9.6.11 (Y9FileController.java) github.com
• OSV entry CVE-2026-110115 osv.dev
• HackMD technical write-up hackmd.io
• VulDB entry 417834 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:25.