Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.

A path traversal vulnerability exists in Yamcs, an open-source mission control framework, prior to version 5.11.13. The flaw resides in StaticFileHandler.java, where the locateFile method resolves unauthenticated request paths without applying Path.normalize or Path.toAbsolutePath to validate that the resolved path stays within the configured staticRoots directory. An unauthenticated attacker can craft a request with directory traversal segments (e.g., ../) to escape the web root and read arbitrary files accessible to the Yamcs process on the host system. This can lead to disclosure of sensitive operating system files, application configuration, and credentials. No authentication is required to exploit this vulnerability, significantly raising its risk profile. The flaw is fixed in Yamcs versions 5.11.13 and 5.12.0. Users are strongly advised to upgrade immediately. Fixes are also available via two specific commits on the Yamcs GitHub repository.