CVE-2026-55552: Yamcs Unauthenticated Directory Traversal via Double-Slash URI
A missing path check in Yamcs's built-in web server lets anyone read any file on the host machine without logging in, just by prepending a double slash to the file path in a browser URL.

The problem
Yamcs ships a Netty-based HTTP server that serves static files through StaticFileHandler.java. The handler takes the raw request URI and maps it to a file on disk without first canonicalizing or boundary-checking the path.
A URI beginning with // (two forward slashes) is treated by the OS as an absolute path, not a path relative to the web root. This lets any unauthenticated attacker read arbitrary files, including /etc/passwd, private keys, or Yamcs configuration files that may contain credentials.
Proof of concept
A working proof-of-concept for CVE-2026-55552 in org.yamcs:yamcs-core, with the exact payload below.
GET //etc/passwd HTTP/1.1
Host: yamcs-host:8090The root cause is in StaticFileHandler.java: the code constructs a File object directly from the URI string without normalizing repeated leading slashes. On POSIX systems, //etc/passwd and /etc/passwd are equivalent, so the resolved path falls outside the intended static-file root entirely.
The web-root prefix check never fires because the comparison is done on the unnormalized string.
The patch (commits c7dfd24 and f4bc588) adds an explicit check in HttpRequestHandler.java that rejects any URI containing consecutive slashes or that resolves, after normalization, to a path outside the configured web root, returning HTTP 403 before the file is ever opened.
This maps to CWE-22.
The fix
Upgrade to yamcs-core 5.11.13 (backport) or 5.12.0 (latest). No workaround short of placing a reverse proxy in front that strips or rejects URIs with consecutive leading slashes.
Reported by Abderrahim Dahmani (STARPWN 2025 CTF, DEFCON 33, VisionSpace Technologies).
Related research
- high · 8.8CVE-2026-55521CVE-2026-55521: Yamcs Core API Multiple Missing Authorization Checks
- critical · 9.8CVE-2026-55559CVE-2026-55559: yamcs-core Remote Code Execution via Instance Template YAML Injection
- critical · 9.1CVE-2026-55511CVE-2026-55511: yamcs-core Authenticated RCE via StreamSQL Aggregate Column-Name Injection
- high · 7.1CVE-2026-54077CVE-2026-54077: ArcadeDB IMPORT DATABASE SSRF and Local File Read