CVE Alert: CVE-2026-110115 – risesoft-y9 – Digital

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.

**Risk verdict:** Treat internet-reachable instances as urgent remediation candidates: the unauthenticated, low-friction file read can expose secrets, although KEV, SSVC, PoC and EPSS status were not provided.

**Why this matters:** The direct impact is loss of confidentiality, but exposed configuration may contain credentials that let attackers access databases, caches or service registries. That can turn a file-read issue into follow-on data theft or broader compromise; actual reach depends on credential scope and network controls.

**Most likely attack path:** An attacker sends crafted path parameters to the network-accessible file retrieval handler; no account, user action or special conditions are needed. The expected impact stays within the vulnerable application’s security scope, but recovered credentials could enable access to adjacent services and facilitate lateral movement.

**Who is most exposed:** Prioritise organisations running the affected file-management component on internet-facing or broadly reachable application servers, especially deployments with secrets stored in readable configuration files.

Alert on requests to the retrieval endpoint containing traversal sequences or encoded variants.

Review web and application logs for unusual file retrievals, repeated path probing, or responses involving configuration files.

Check for unexpected use of database, cache or registry credentials from unfamiliar hosts.

Mitigation and prioritisation:

Confirm the vendor’s fixed release and upgrade promptly; the supplied data does not identify a remediation release.

Until patched, restrict access to the endpoint at the reverse proxy or firewall; do not rely on authentication if the handler bypasses it.

Rotate exposed secrets and assess their use across dependent services.

Test the change in staging, then verify traversal attempts are rejected and logs are retained.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.