CVE-2026-75337 Overview
CVE-2026-75337 is a path traversal vulnerability in the static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3. The application concatenates user-controlled path segments to the preview root directory without normalization. Anonymous attackers can craft requests containing ../ sequences to read files outside the intended preview root. The vulnerability requires no authentication and can be triggered remotely over the network. Successful exploitation exposes source code, configuration files, credentials, and other sensitive data on the host filesystem. The flaw is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Critical Impact
Unauthenticated remote attackers can read arbitrary files on the host, including application secrets and system configuration.
Affected Products
- Yu AI Code Mother v4.3
- Deployments exposing the /api/static/{deployKey}/ endpoint
- Instances relying on preview-root path handling without normalization
Discovery Timeline
- 2026-08-28 - CVE-2026-75337 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-75337
Vulnerability Analysis
The /api/static/{deployKey}/ handler serves preview assets from a designated root directory. The handler takes the request path segment supplied by the client and appends it directly to the preview root string. Because no canonicalization or traversal filtering is applied, sequences such as ../ resolve upward through the filesystem hierarchy. An attacker sends a crafted URL and the server returns the file at the resolved path. The endpoint accepts anonymous requests, so no credentials or user interaction are required to exploit the flaw. Impact spans confidentiality, integrity, and availability because leaked credentials and configuration data enable follow-on attacks against the host and connected services.
Root Cause
The root cause is missing input validation on the deployKey and trailing path components. The application constructs the target file path via naive string concatenation with the preview root. It does not enforce that the resolved absolute path remains inside the intended base directory. Standard defenses such as canonical path resolution, base-directory prefix checks, and rejection of .. segments are absent.
Attack Vector
An attacker issues an HTTP GET request to the static resource endpoint with directory traversal sequences embedded in the URL. The server resolves the path outside the preview root and returns the file contents to the unauthenticated caller. See the public proof-of-concept for request examples targeting files such as application configuration and OS-level files.
Detection Methods for CVE-2026-75337
Indicators of Compromise
- HTTP requests to /api/static/ containing ../, ..%2f, or URL-encoded traversal sequences
- Access log entries returning HTTP 200 for paths that resolve outside the preview root
- Unexpected reads of configuration files such as application.yml, .env, or /etc/passwd originating from the web process
- Anonymous requests to the static resource endpoint from unfamiliar external IP ranges
Detection Strategies
- Alert on any request to /api/static/{deployKey}/ where the decoded path contains .. segments or absolute path indicators
- Correlate web access logs with filesystem audit logs to identify reads of sensitive files by the application process
- Deploy signatures in web application firewalls (WAF) to flag path traversal payloads targeting the static endpoint
Monitoring Recommendations
- Enable verbose access logging on Yu AI Code Mother instances and forward to a central log platform
- Establish a baseline of legitimate deployKey values and alert on deviations
- Monitor for spikes in 200-status responses on the static endpoint originating from single source IPs
How to Mitigate CVE-2026-75337
Immediate Actions Required
- Restrict network exposure of the /api/static/{deployKey}/ endpoint to trusted networks until a patch is available
- Place the application behind a WAF configured to block path traversal payloads and URL-encoded traversal variants
- Rotate any secrets, tokens, or credentials that resided in files reachable from the preview root
- Audit access logs for prior exploitation attempts against the static resource endpoint
Patch Information
No vendor patch reference is included in the NVD entry at the time of publication. Track vendor communications from the Yu AI Code Mother project for a fixed release. Consult the public technical write-up for current exploitation details.
Workarounds
- Implement a reverse proxy rule that rejects requests to /api/static/ containing .., %2e%2e, or backslash sequences
- Run the application under a least-privilege service account that cannot read sensitive system files
- Move sensitive configuration and secrets outside any directory reachable from the preview root
- Disable the static resource interface if it is not required for production operation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.