CVE-2026-110115 in Digital-Infrastructure
Summary
by MITRE • 10/13/2026
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Risesoft Digital-Infrastructure versions 9.6.5 through 9.6.11 represents a critical security flaw rooted in improper input validation within the file management subsystem. Specifically, the issue resides in the Y9FileController.retrieveFileStream handler, which is responsible for serving files requested by users or applications. This component fails to adequately sanitize user-supplied input before processing it as part of a filesystem path operation. The core technical deficiency is a classic Path Traversal vulnerability, often categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. In this context, the application does not strictly enforce that the requested file resides within an intended safe directory or validate that the resolved absolute path remains confined to the expected scope. Consequently, attackers can manipulate the fullPath and fileName parameters by injecting parent-directory traversal sequences, such as ../, which instructs the underlying operating system to navigate up the directory hierarchy from the current working directory.
This lack of input validation allows unauthenticated actors to exploit the endpoint at /rest/retrieveFileStream without requiring any form of authentication or valid session tokens. By carefully constructing HTTP requests that include these traversal sequences in the specified parameters, an attacker can bypass access controls and read arbitrary files present on the server's filesystem. The operational impact of this vulnerability is severe because it effectively grants remote code execution-level insight into the system's configuration and secrets management. Since digital infrastructure platforms typically store sensitive credentials for backend services within their primary configuration files, such as application.yml or similar property files, an attacker can extract these details with ease. This includes database connection strings containing usernames and passwords, Redis authentication tokens, and Nacos service discovery credentials.
The exposure of these credentials poses a significant risk to the integrity and confidentiality of the entire infrastructure ecosystem. Once an adversary obtains database credentials, they may attempt direct SQL injection attacks or unauthorized data exfiltration against the backend databases. Similarly, access to Redis keys can lead to cache poisoning or further lateral movement within the network if Redis is used for session storage or inter-service communication. Nacos credentials are particularly dangerous as they often provide administrative control over service registration and configuration management, allowing an attacker to manipulate microservice behaviors or inject malicious configurations into running services. This aligns with ATT&CK technique T1083: File and Directory Discovery, where adversaries search for sensitive information on compromised systems to facilitate further exploitation stages such as Credential Access (T1552) or Lateral Movement (T1021).
To mitigate this vulnerability, immediate patching of the Risesoft Digital-Infrastructure software to a version beyond 9.6.11 is required if available from the vendor. In cases where an upgrade is not immediately feasible, network-level controls should be implemented to restrict access to the /rest/retrieveFileStream endpoint, ensuring that only authenticated and authorized users can interact with it. Additionally, input validation mechanisms must be strengthened on any custom implementations or workarounds by implementing strict allow-listing of permitted file extensions and characters, as well as canonicalizing paths before processing them to ensure they do not escape the designated directory boundaries. Regular security audits and static code analysis should also be employed to detect similar path traversal flaws in other parts of the application logic that handle user-supplied filenames or paths.