Unauthenticated Directory Traversal in Yamcs

Yamcs versions prior to 5.11.13 are susceptible to an unauthenticated directory traversal vulnerability (CVE-2026-55552) residing in the HttpRequestHandler.java and StaticFileHandler.java components. This flaw allows remote, unauthenticated attackers to bypass intended directory restrictions by crafting specific HTTP requests containing traversal sequences. An attacker can leverage this to retrieve sensitive system files, configuration files, or other data residing on the host filesystem where Yamcs is deployed. Given the nature of the application as a mission control system, exposure of sensitive configuration or authentication files poses a significant risk to the integrity and confidentiality of the entire environment.

Impact

Successful exploitation grants an unauthenticated attacker the ability to read arbitrary files from the filesystem of the host running the Yamcs service. This can lead to the exfiltration of credentials, system configuration details, or sensitive operational data, potentially facilitating further unauthorized access or complete system compromise.

Recommendation

1. Upgrade Yamcs to version 5.11.13 or later immediately to patch CVE-2026-55552.
2. Implement network-level access controls to restrict access to the Yamcs management interface to known, trusted IP ranges.
3. Deploy the provided Sigma rule to web server access logs to detect directory traversal attempts.
4. Perform a log review for any historical GET requests to the Yamcs interface containing '..' or unusual path indicators.