CVE-2026-55552

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.11.13 Yamcs versions prior to 5.12.0

Description An unauthenticated directory traversal issue exists where the StaticFileHandler.locateFile() function fails to use Path.normalize and Path.toAbsolutePath to verify that the requested path remains within the configured staticRoots. This allows a remote attacker to use traversal segments in a request path to escape the intended web root and access arbitrary readable files on the underlying host operating system, potentially disclosing sensitive system and application data.

Recommendations Update to version 5.11.13 or later. Update to version 5.12.0 or later.