CVE-2026-110116: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in risesoft-y9 Digital-Infrastructure

CVE-2026-110116 is a path traversal vulnerability affecting Risesoft-y9 Digital-Infrastructure versions 9.6.5 through 9.6.11. The vulnerability exists in the fileManager storeFile endpoint, which improperly limits pathname inputs. Attackers can exploit this by sending specially crafted fullPath and fileName parameters to the POST /rest/storeFile endpoint, allowing them to write arbitrary files without authentication. This can lead to overwriting or creating files with service-level permissions, potentially resulting in remote code execution.

An unauthenticated attacker can write arbitrary files on the affected system, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 4.0 base score of 8.8, indicating high severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to file uploads. Avoid exposing the fileManager storeFile endpoint to untrusted networks.