CVE-2026-110115: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in risesoft-y9 Digital-Infrastructure

CVE-2026-110115 is a path traversal vulnerability affecting Risesoft Digital-Infrastructure versions 9.6.5 through 9.6.11. The vulnerability exists in the unauthenticated /rest/retrieveFileStream endpoint handled by fileManager Y9FileController.retrieveFileStream. Attackers can supply parent-directory segments in the fullPath and fileName parameters to read arbitrary files on the server, including sensitive configuration files like application.yml that may disclose critical credentials.

An unauthenticated attacker can read arbitrary files on the affected system, potentially exposing sensitive information such as database, Redis, and Nacos credentials. This can lead to further compromise of the system or connected infrastructure components. The vulnerability has a high severity with a CVSS 4.0 score of 8.7, indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /rest/retrieveFileStream endpoint and monitor for suspicious requests attempting directory traversal patterns. Avoid exposing this endpoint publicly if possible.