CVE-2026-55552: Yamcs Path Traversal Vulnerability

CVE-2026-55552 Overview

CVE-2026-55552 is a path traversal vulnerability [CWE-22] in Yamcs, an open-source mission control framework used to monitor and control spacecraft and other remote assets. The flaw resides in the StaticFileHandler.locateFile method within yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java. The handler resolves unauthenticated request paths against configured staticRoots without calling Path.normalize or Path.toAbsolutePath to validate containment. A remote attacker can supply traversal segments to escape the intended web root and read arbitrary files readable by the Yamcs process. The issue is fixed in versions 5.11.13 and 5.12.0.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from the host, disclosing sensitive operating system and mission control application data.

Affected Products

Yamcs versions prior to 5.11.13
Yamcs 5.12 line prior to 5.12.0
yamcs-core HTTP static file handler component

Discovery Timeline

2026-08-28 - CVE-2026-55552 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55552

Vulnerability Analysis

Yamcs exposes an HTTP interface that serves static assets from one or more configured staticRoots directories. The locateFile method in StaticFileHandler resolves the incoming request path against each root using Path.resolve and immediately converts the result to a File. Because Path.resolve does not collapse .. segments or verify that the resulting path stays within its base, an attacker can submit crafted URIs containing traversal sequences. The resolved path escapes the static root and points at arbitrary files on the host filesystem. Any file readable by the Yamcs service user, including configuration files, credentials, private keys, and mission telemetry data, can be returned in the HTTP response.

Root Cause

The root cause is missing canonicalization and containment validation before file access. The pre-patch code performed staticRoot.resolve(path).toFile() and only checked isHidden() and exists(). It did not normalize the path or confirm that the absolute resolved path begins with the absolute path of the static root.

Attack Vector

Exploitation requires only network access to the Yamcs HTTP endpoint serving static content. No authentication or user interaction is required. An attacker issues an HTTP GET request with directory traversal sequences appended to a static file route, causing the server to return the contents of files outside the intended web root.

java

// Patch: yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java
// Constrain static files to any of the static roots

-    protected File locateFile(String path) {
+    protected File locateFile(String pathString) {
         for (var staticRoot : staticRoots) { // Stop on first match
-            var file = staticRoot.resolve(path).toFile();
-            if (!file.isHidden() && file.exists()) {
-                return file;
+            var path = staticRoot.resolve(pathString);
+
+            if (path.normalize().toAbsolutePath().startsWith(staticRoot.normalize().toAbsolutePath())) {
+                var file = path.toFile();
+                if (!file.isHidden() && file.exists()) {
+                    return file;
+                }
             }
         }
         return null;

Source: Yamcs commit c7dfd24

Detection Methods for CVE-2026-55552

Indicators of Compromise

HTTP request URIs to Yamcs static file routes containing ../, ..%2f, %2e%2e/, or other encoded traversal sequences.
HTTP 200 responses returning content types or file sizes inconsistent with expected static assets (for example, responses that return /etc/passwd or Yamcs configuration files).
Access log entries showing sequential probing of common sensitive paths such as /etc/shadow, /proc/self/environ, or Yamcs mdb and configuration directories.

Detection Strategies

Deploy web application firewall (WAF) rules that flag traversal patterns in requests to Yamcs HTTP endpoints.
Parse Yamcs and reverse proxy access logs for URI-decoded .. segments targeting static routes.
Compare served response file paths against the configured staticRoots allowlist and alert on divergence.

Monitoring Recommendations

Enable verbose HTTP access logging on the Yamcs server and forward logs to a centralized analytics platform.
Monitor filesystem read audit events on hosts running Yamcs for reads originating from the Yamcs process against paths outside staticRoots.
Alert on outbound HTTP responses from Yamcs that exceed baseline size distributions for static assets.

How to Mitigate CVE-2026-55552

Immediate Actions Required

Upgrade Yamcs to version 5.11.13 on the 5.11 branch or 5.12.0 or later on the 5.12 branch.
Restrict network exposure of the Yamcs HTTP interface to trusted management networks only.
Run the Yamcs process under a least-privileged service account with no read access to sensitive system files or unrelated application data.

Patch Information

The fix is delivered in Yamcs 5.11.13 and Yamcs 5.12.0. The patch, applied in commits c7dfd24 and f4bc588, adds a normalize().toAbsolutePath().startsWith(...) containment check in StaticFileHandler.locateFile. Details are documented in GHSA-9jg3-g3wh-w9pj.

Workarounds

Place a reverse proxy in front of Yamcs and reject request URIs containing .., %2e%2e, or other traversal encodings before forwarding.
Remove or restrict the static file serving configuration by minimizing directories listed under staticRoots and hosting static assets from a separate hardened web server.
Apply operating system mandatory access controls such as AppArmor or SELinux profiles that confine the Yamcs process to only its required directories.

bash

# Example nginx reverse proxy rule to block traversal attempts
location / {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/|%2e%2e%2f)") {
        return 400;
    }
    proxy_pass http://yamcs-backend:8090;
}