CVE-2026-110116

Summary

A path traversal vulnerability in Risesoft-y9 Digital-Infrastructure allows unauthenticated attackers to write arbitrary files to the server, potentially leading to code execution. This flaw exists in the fileManager storeFile endpoint and affects versions 9.6.5 through 9.6.11.

Exploitability

Exploitation is straightforward with no authentication required, needing only a POST request to /rest/storeFile with crafted fullPath and fileName parameters to overwrite service-writable files.

Blast radius

The vulnerability could enable attackers to write malicious files that the application service can execute, potentially leading to full system compromise if the service has sufficient privileges.

Detection

Monitor for POST requests to /rest/storeFile with unusual fullPath values that could indicate file overwrite attempts, and watch for newly created or modified files in service-writable directories that don't correspond to legitimate application operations.

Prioritized remediation

Upgrade to version 9.6.12 or later to remediate this path traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.