Risesoft-y9 Digital-Infrastructure: Path traversal in storeFile allows arbitrary file write
Summary
The file manager microservice of Risesoft-y9 Digital-Infrastructure does not validate the fullPath and fileName parameters of the storeFile endpoint (POST /rest/storeFile). An unauthenticated remote attacker can write files to arbitrary locations the service process can write to, which may lead to code execution by overwriting service-writable files. The issue is classified as CWE-22 and CVSS 4.0 8.8 in the CVE record.
Affected
- Digital-Infrastructure 9.6.5 through 9.6.11
- Exact affected range according to the CNA: 9.6.5 to 9.6.11 inclusive; the researcher also confirmed v9.6.7 and v9.6.11; earlier versions not verified
Fixed in
Unknown. A fix commit (b9dddb7c) is referenced, but the first released version containing it has not been confirmed.
Workaround
- No vendor-issued mitigation found.
- Block or restrict access to the /rest/ API paths from untrusted networks, e.g. via VPN or an allowlisting reverse proxy.
- Limit the write permissions of the service account to what the application needs.
Exploitation
- No evidence of active exploitation found; not listed in CISA KEV at the time of research.
- Public proof of concept: unconfirmed.
- Automatable: yes (CISA SSVC).
- EPSS: about 0.59 percent according to cvedetails.
Our recommendation
- Check whether any Digital-Infrastructure instance is in use, including test systems and vendor-hosted instances.
- If an instance is reachable from the internet, restrict access to the /rest/ paths immediately.
- Update to a release that contains the fix as soon as the vendor confirms it; until then, treat the system as exposed.
- Check for unexpected new or changed files in application and configuration directories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record source: GitHub Y9FileController.java v9.6.11 github.com
- HackMD technical write-up on file manager path traversal hackmd.io
- VulnCheck advisory www.vulncheck.com
- OSV record CVE-2026-110116 osv.dev
- Strix CVE-2026-110116 www.strix.ai
- Digital-Infrastructure GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:06.
Original description (NVD)
Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or overwrite service-writable files, potentially achieving code execution.
NVD references (3)
- https://github.com/risesoft-y9/Digital-Infrastructure/blob/v9.6.11/y9-digitalbase-module/y9-module-filemanage…
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/digital-infrastructure-filemanager-path-traversal-rw
- https://www.vulncheck.com/advisories/digital-infrastructure-9.6.5-through-9.6.11-path-traversal-via-filemanag…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.