CVE-2026-75337: n/a

CVE-2026-75337 describes a path traversal vulnerability in Yu AI Code Mother version 4.3. The static resource interface at /api/static/{deployKey}/ improperly handles user input by concatenating it directly to the preview root directory path without normalization. This flaw allows unauthenticated attackers to craft requests that access arbitrary files on the server outside the designated preview root directory, potentially exposing sensitive information. The vulnerability is identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported.

An anonymous attacker can exploit this vulnerability to read arbitrary files on the server hosting Yu AI Code Mother v4.3. This can lead to disclosure of sensitive information, compromise of system confidentiality, integrity, and availability. The critical CVSS score reflects the high risk of exploitation without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected interface if possible and monitor for suspicious requests targeting the /api/static/{deployKey}/ endpoint. Avoid exposing this interface publicly if feasible.