CVE-2026-55552

CVE-2026-55552 is a path traversal flaw (CWE-22) in the StaticFileHandler of Yamcs, an open-source mission control framework. Because StaticFileHandler.locateFile resolves unauthenticated request paths without normalizing them or verifying that the resulting absolute path stays within the configured staticRoots, a request containing traversal segments (e.g., ../ sequences) can escape the intended web root. An attacker who can reach the Yamcs HTTP interface can thus read any file on the host that is readable by the Yamcs process, potentially disclosing operating-system and application data such as configuration files or credentials. Any deployment running an affected version of yamcs-core with the static file interface reachable by untrusted clients is exposed, though many mission-control installations run on isolated networks. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known; EPSS estimates only a 0.4% probability of exploitation in the next 30 days.

What to do: Upgrade Yamcs to 5.11.13, or to 5.12.0 or later if following the 5.12 line. As interim mitigation, restrict network access to the Yamcs HTTP interface to trusted clients (or place a reverse proxy that normalizes paths in front of it), and audit which host files are readable by the Yamcs process; review web logs for unauthenticated requests containing ../ or encoded traversal segments against static file endpoints.