high · 7.5CVE-2026-55552Aug 28, 2026

CVE-2026-55552: Yamcs Unauthenticated Directory Traversal via Double-Slash URI

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A missing path check in Yamcs's built-in web server lets anyone read any file on the host machine without logging in, just by prepending a double slash to the file path in a browser URL.

Packageorg.yamcs:yamcs-core
Ecosystemmaven
Affected< 5.11.13
Fixed in5.12.0
CVE-2026-55552: Yamcs Unauthenticated Directory Traversal via Double-Slash URI

The problem

Yamcs ships a Netty-based HTTP server that serves static files through StaticFileHandler.java. The handler takes the raw request URI and maps it to a file on disk without first canonicalizing or boundary-checking the path.

A URI beginning with // (two forward slashes) is treated by the OS as an absolute path, not a path relative to the web root. This lets any unauthenticated attacker read arbitrary files, including /etc/passwd, private keys, or Yamcs configuration files that may contain credentials.

Proof of concept

A working proof-of-concept for CVE-2026-55552 in org.yamcs:yamcs-core, with the exact payload below.

http
GET //etc/passwd HTTP/1.1
Host: yamcs-host:8090

The root cause is in StaticFileHandler.java: the code constructs a File object directly from the URI string without normalizing repeated leading slashes. On POSIX systems, //etc/passwd and /etc/passwd are equivalent, so the resolved path falls outside the intended static-file root entirely.

The web-root prefix check never fires because the comparison is done on the unnormalized string.

The patch (commits c7dfd24 and f4bc588) adds an explicit check in HttpRequestHandler.java that rejects any URI containing consecutive slashes or that resolves, after normalization, to a path outside the configured web root, returning HTTP 403 before the file is ever opened.

This maps to CWE-22.

The fix

Upgrade to yamcs-core 5.11.13 (backport) or 5.12.0 (latest). No workaround short of placing a reverse proxy in front that strips or rejects URIs with consecutive leading slashes.

Reported by Abderrahim Dahmani (STARPWN 2025 CTF, DEFCON 33, VisionSpace Technologies).

References: [1][2][3][4][5][6]

Related research