CVE-2026-75333 Overview
CVE-2026-75333 is a path traversal vulnerability in yx-image-recognition v1.0. The application accepts user-controlled parameters such as dir and filePath and passes them directly to new File() for file system operations. The code performs no path sanitization or whitelist validation. Attackers can supply crafted path values containing traversal sequences to read from or write to arbitrary locations on the underlying file system.
Critical Impact
Unauthenticated or authenticated attackers can traverse outside intended directories using parameters like dir and filePath, exposing sensitive files or enabling arbitrary file writes.
Affected Products
- yx-image-recognition v1.0
Discovery Timeline
- 2026-08-26 - CVE-2026-75333 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-75333
Vulnerability Analysis
yx-image-recognition v1.0 exposes endpoints that accept file system paths as request parameters. The parameters dir and filePath flow directly into Java new File(path) constructors used for listing, reading, or writing files. Without canonicalization or an allowlist, an attacker can inject relative traversal segments such as ../ to escape the intended working directory.
This is a classic Path Traversal weakness [CWE-22]. The attacker controls the full file system path resolution because the application never normalizes the input, never resolves it against a fixed base directory, and never verifies the canonical path remains within an approved root.
Root Cause
The root cause is missing input validation on path parameters. The application trusts user-supplied strings as safe file locations. Java's File API resolves relative components including .. when the JVM performs I/O, so unsanitized input directly maps to arbitrary file system paths.
Attack Vector
An attacker submits an HTTP request to an affected endpoint with a dir or filePath value containing directory traversal sequences. For example, a value like ../../../../etc/passwd on Linux or ..\..\Windows\win.ini on Windows resolves outside the application's intended directory. Depending on which handler consumes the parameter, the result can be arbitrary file read, directory enumeration, or arbitrary file write. Refer to the GitHub Path Traversal Report for endpoint-level details.
Detection Methods for CVE-2026-75333
Indicators of Compromise
- HTTP requests to yx-image-recognition endpoints containing ../, ..\, or URL-encoded variants (%2e%2e%2f, %2e%2e%5c) in dir or filePath parameters.
- Application access to files outside the yx-image-recognition installation directory, such as /etc/passwd, /etc/shadow, or Windows system files.
- Unexpected file writes performed by the yx-image-recognition process user in system or configuration directories.
Detection Strategies
- Inspect web server and application logs for query strings or JSON bodies containing traversal tokens targeting dir or filePath.
- Deploy WAF rules that flag traversal payloads on request parameters known to reference file paths.
- Correlate process-level file access telemetry with HTTP request logs to identify path resolution outside the application root.
Monitoring Recommendations
- Enable file integrity monitoring on directories adjacent to the yx-image-recognition installation and on sensitive system paths.
- Alert on the yx-image-recognition JVM opening files outside its designated data directory.
- Track error responses referencing FileNotFoundException or permission failures, which often accompany traversal probing.
How to Mitigate CVE-2026-75333
Immediate Actions Required
- Restrict network access to yx-image-recognition v1.0 endpoints that consume dir or filePath parameters until a fix is applied.
- Run the application under a low-privilege service account that cannot read sensitive system files or write outside its data directory.
- Deploy WAF or reverse-proxy rules that reject traversal sequences and encoded variants on affected parameters.
Patch Information
No vendor patch is referenced in the available CVE data. Monitor the GitHub Path Traversal Report and the upstream yx-image-recognition project for a fixed release. Until a patched version ships, treat all deployments of v1.0 as vulnerable.
Workarounds
- Place yx-image-recognition behind a reverse proxy that normalizes URLs and blocks requests containing .., %2e%2e, or absolute path prefixes on dir and filePath.
- Apply operating system controls such as chroot, containers, or mandatory access control profiles (AppArmor, SELinux) to constrain the process file system view.
- If source modification is possible, validate each path by resolving it with File.getCanonicalPath() and rejecting any result that does not start with the approved base directory.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
