CVE-2026-10075: DreamMaker Path Traversal Vulnerability

CVE-2026-10075 Overview

DreamMaker, developed by Interinfo, contains an absolute path traversal vulnerability that allows unauthenticated remote attackers to enumerate file names under arbitrary paths on the affected system. The flaw is classified under [CWE-36] Absolute Path Traversal and is exploitable over the network without authentication or user interaction. Successful exploitation discloses file and directory names outside the intended application scope, providing reconnaissance value for follow-on attacks against the host.

Critical Impact
Unauthenticated remote attackers can enumerate file names across arbitrary directories on the DreamMaker host, exposing sensitive filesystem structure.

Affected Products

DreamMaker (developed by Interinfo)

Discovery Timeline

2026-05-29 - CVE CVE-2026-10075 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-10075

Vulnerability Analysis

The vulnerability resides in DreamMaker's handling of file path parameters supplied through network-accessible endpoints. The application accepts absolute paths from remote clients without restricting access to a permitted base directory. An unauthenticated attacker can submit a crafted path value to retrieve the list of file names located in any directory readable by the DreamMaker service account.

The disclosed scope is limited to file name enumeration rather than full file content retrieval. However, the information returned still exposes installation layouts, configuration file names, backup archives, user data directories, and credential-related artifacts. This data accelerates targeted attacks because adversaries can map the filesystem and identify high-value files prior to attempting further exploitation.

The attack requires no privileges, no user interaction, and is exploitable over the network with low complexity. Because DreamMaker is typically deployed as a server-side business application, the service account often holds broader filesystem read permissions than a standard user. This widens the surface that an attacker can enumerate through the flaw.

Root Cause

The root cause is missing input validation on path parameters consumed by the application's file handling logic. DreamMaker does not enforce canonicalization or restrict requests to a designated working directory. Absolute paths submitted by the client are passed directly to filesystem listing functions, classifying the defect under [CWE-36] Absolute Path Traversal.

Attack Vector

The attack vector is network-based. An attacker sends an HTTP request to a vulnerable DreamMaker endpoint and supplies an absolute filesystem path as a parameter value. The server responds with the names of files contained at that path. The vulnerability mechanism is described in the TWCERT Security Advisory; no public proof-of-concept exploit code is referenced in the available data.

Detection Methods for CVE-2026-10075

Indicators of Compromise

HTTP requests to DreamMaker endpoints containing absolute path values such as C:\, D:\, or /etc/ in query strings or POST bodies.
Unusual file enumeration responses returning directory listings outside the application's web root.
Repeated requests from a single source iterating through common system paths within short time windows.

Detection Strategies

Inspect web server and application logs for path traversal patterns including absolute path prefixes and encoded variants such as %2F and %5C.
Deploy web application firewall rules that flag requests containing absolute paths against DreamMaker URIs.
Correlate anomalous filesystem read activity by the DreamMaker service account with inbound HTTP requests.

Monitoring Recommendations

Forward DreamMaker application and IIS or web gateway logs to a centralized SIEM for traversal pattern detection.
Alert on bursts of 4xx and 2xx responses tied to file enumeration parameters from non-administrative source IPs.
Monitor outbound connections from the DreamMaker host following enumeration activity for signs of staged follow-on attacks.

How to Mitigate CVE-2026-10075

Immediate Actions Required

Restrict network access to DreamMaker management and file-handling endpoints to trusted administrative networks only.
Review the vendor advisory at TWCERT Security Advisory and apply the patched version distributed by Interinfo.
Audit web server logs for prior exploitation attempts referencing absolute paths on the DreamMaker host.

Patch Information

Interinfo has issued a security update for DreamMaker as coordinated through TWCERT. Refer to the TWCERT Security Alert and the TWCERT Security Advisory for the fixed version and upgrade instructions. Apply the vendor-supplied update to remove the absolute path traversal flaw.

Workarounds

Place DreamMaker behind a reverse proxy or WAF that blocks requests containing absolute path syntax and traversal sequences.
Reduce the DreamMaker service account's filesystem read permissions to only the directories required for application operation.
Segment the DreamMaker host on a restricted VLAN and require VPN access for any external administration.

bash

# Example WAF rule (ModSecurity) to block absolute path parameters
SecRule ARGS "@rx (?i)(^|=)([a-z]:\\\\|/etc/|/var/|/root/)" \
    "id:1010075,phase:2,deny,status:403,\
    msg:'CVE-2026-10075 DreamMaker absolute path traversal attempt'"