CVE-2026-10075 describes an Absolute Path Traversal vulnerability in the DreamMaker software developed by Interinfo. This vulnerability permits unauthenticated remote attackers to read file names located at arbitrary paths on the affected system by exploiting improper validation of file path inputs. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality. No official fix or patch has been published as of the data provided.

The vulnerability allows attackers to read file names under arbitrary paths remotely without authentication. This could lead to information disclosure about the file system structure or presence of sensitive files. There is no indication of further impacts such as file content disclosure, modification, or system compromise. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected DreamMaker service to trusted users only and monitor for suspicious activity related to file path requests. Avoid exposing the service directly to untrusted networks.