TI-2026-71999 Aliases CVE-2026-110115 GHSA-qqmw-cvh2-5395

Path traversal in Risesoft Digital-Infrastructure file retrieval

MEDIUM 44CWE-22Published 2026-10-13 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Risesoft Digital-Infrastructure from 9.6.5 through 9.6.11 contains a path traversal flaw (CWE-22) in the fileManager retrieveFileStream handler. The handler does not restrict parent-directory segments in its file path inputs, which lets an unauthenticated remote attacker read arbitrary files. Files such as application.yml expose database, Redis and Nacos credentials.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00433 37th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
risesoft-y9	Digital-Infrastructure	9.6.5 – 9.6.11	—	No fix listed	CNA

Digital-Infrastructure Vendorrisesoft-y9 Affected 9.6.5 – 9.6.11 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Digital-Infrastructure.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Timeline

2026-10-13 Threatist record created from CVE-2026-110115
2026-10-13 Alias added: GHSA-qqmw-cvh2-5395
2026-10-14 CISA SSVC decision points changed

References

Advisory 1

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/digital-infrastructure-filemanager-path-traversal-rw

Other 1

https://github.com/risesoft-y9/Digital-Infrastructure/blob/v9.6.11/y9-digitalbase-module/y9-module-filemanager/risenet-y9boot-webapp-filemanager/src/main/java/net/risesoft/y9public/controller/Y9FileController.java#L136-L166

TI-2026-65446 risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection CVSS 4.0MEDIUM 6.9
TI-2026-00785 risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injection CVSS 4.0MEDIUM 6.9
TI-2025-06470 risesoft-y9 Digital-Infrastructure Y9FileController.java deleteFile path traversal CVSS 4.0MEDIUM 5.3
TI-2026-72000 Path traversal in Risesoft-y9 Digital-Infrastructure lets attackers write files CVSS 4.0HIGH 8.8
TI-2026-75437 Risesoft Digital-Infrastructure exposes other tenants' personnel data CVSS 4.0HIGH 7.1
TI-2026-72002 Missing authorization in WorkFlow-Engine task buttonOperation endpoints CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences