CVE-2026-75337

Yu AI Code Mother v4.3 exposes a static resource endpoint, /api/static/{deployKey}/, that concatenates a user-controlled path onto the preview root directory without any normalization. Because the endpoint requires no authentication, an anonymous network attacker can submit crafted traversal sequences to read files located outside the preview root. Successful exploitation yields arbitrary file disclosure, potentially exposing configuration files, credentials, or other sensitive data readable by the service process; the assigned CVSS 3.1 score of 9.8 rates confidentiality, integrity, and availability impact as high. Any deployment of AI Code Mother v4.3 with this endpoint reachable over the network is affected, though the available data does not specify whether other versions are also vulnerable. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known, and EPSS estimates only a 0.4% probability of exploitation within the next 30 days.

What to do: Contact the vendor to confirm whether a patched release exists and upgrade as soon as one is available, since the available data does not list a fixed version. In the meantime, restrict network access to the /api/static/{deployKey}/ endpoint (e.g., reverse-proxy path normalization or a WAF rule blocking ../ and encoded traversal sequences), limit the service process's file-system read scope, and review access logs for traversal-pattern requests against this endpoint.