CVE-2026-75333 in yx-image-recognition
Summary
by MITRE • 08/27/2026
yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File() for file system operations without any path sanitization or whitelist validation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in yx-image-recognition version 1.0 represents a critical security flaw classified under the CWE-22 category of Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal. This type of vulnerability arises when an application fails to properly sanitize or validate user-supplied input before using it in file system operations. In this specific instance, parameters such as dir and filePath are directly passed to the new File() constructor without any form of path normalization, canonicalization, or whitelist validation. The absence of these security controls allows an attacker to manipulate the intended directory structure by injecting special characters like dot-dot-slash sequences into the input fields.
From a technical perspective, the core issue lies in how the underlying operating system interprets file paths when they are constructed dynamically from user input. When parameters like dir and filePath are concatenated or passed directly without sanitization, an attacker can craft requests that traverse up the directory hierarchy using relative path notation. For example, by supplying inputs such as ../../etc/passwd or similar constructs depending on the target operating system, the application may resolve these paths to locations outside of the intended web root or data directory. This behavior effectively bypasses any implicit security boundaries established by the application's folder structure, granting access to sensitive files that should remain inaccessible to end users.
The operational impact of this vulnerability is severe and multifaceted. An attacker with network access to the yx-image-recognition service can exploit this flaw to read arbitrary files from the server hosting the application. This capability enables unauthorized disclosure of confidential information, including configuration files containing database credentials, private keys, source code, or other sensitive data stored on the file system. Furthermore, if the underlying environment permits write operations through similar mechanisms, it could potentially lead to remote code execution by overwriting critical executable files or scripts. The attack vector is straightforward and does not require authentication in many default configurations, making it highly exploitable for automated scanning tools and malicious actors seeking initial access to a network infrastructure.
This vulnerability aligns with the MITRE ATT&CK framework under techniques related to Collection and Exfiltration over Alternative Protocols, specifically mapping to file discovery or data from local system directories. It also reflects common patterns found in CWE-73 External Control of File Name which often precedes more severe outcomes like remote code execution if write permissions are involved. The lack of input validation indicates a fundamental gap in the secure coding practices employed during the development phase, highlighting the need for stricter adherence to security standards such as OWASP guidelines on path traversal prevention.
To mitigate this vulnerability, immediate remediation steps should focus on implementing robust input validation and output encoding strategies. Developers must enforce strict whitelist validation for all file paths, ensuring that only predefined directories or files are accessible through the application interface. Additionally, using canonicalization functions to resolve symbolic links and relative paths before performing any file system operations can help neutralize traversal attempts by normalizing the path structure. It is also recommended to run the application with minimal privileges, restricting access to only those directories necessary for its operation, thereby limiting the blast radius in case of a successful exploit. Regular security audits and static code analysis tools should be integrated into the development lifecycle to detect such flaws early before deployment.