TI-2026-72000 Aliases CVE-2026-110116 GHSA-384w-qhxp-j99v

Path traversal in Risesoft-y9 Digital-Infrastructure lets attackers write files

MEDIUM 45CWE-22Published 2026-10-13 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Risesoft-y9 Digital-Infrastructure from 9.6.5 through 9.6.11 contains a path traversal flaw (CWE-22) in the fileManager storeFile endpoint. Because the endpoint does not restrict the target path, an unauthenticated remote attacker can write arbitrary files on the server, which could lead to code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or overwrite service-writable files, potentially achieving code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00592 48th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
risesoft-y9	Digital-Infrastructure	9.6.5 – 9.6.11	—	No fix listed	CNA

Digital-Infrastructure Vendorrisesoft-y9 Affected 9.6.5 – 9.6.11 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Digital-Infrastructure.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Timeline

2026-10-13 Threatist record created from CVE-2026-110116
2026-10-13 Alias added: GHSA-384w-qhxp-j99v

References

Advisory 1

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/digital-infrastructure-filemanager-path-traversal-rw

Other 1

https://github.com/risesoft-y9/Digital-Infrastructure/blob/v9.6.11/y9-digitalbase-module/y9-module-filemanager/risenet-y9boot-webapp-filemanager/src/main/java/net/risesoft/y9public/controller/Y9FileController.java#L168-L182

TI-2026-65446 risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection CVSS 4.0MEDIUM 6.9
TI-2026-00785 risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injection CVSS 4.0MEDIUM 6.9
TI-2025-06470 risesoft-y9 Digital-Infrastructure Y9FileController.java deleteFile path traversal CVSS 4.0MEDIUM 5.3
TI-2026-71999 Path traversal in Risesoft Digital-Infrastructure file retrieval CVSS 4.0HIGH 8.7
TI-2026-75437 Risesoft Digital-Infrastructure exposes other tenants' personnel data CVSS 4.0HIGH 7.1
TI-2026-72002 Missing authorization in WorkFlow-Engine task buttonOperation endpoints CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences