Yamcs has Unauthenticated Directory Traversal

### Attack type: Unauthenticated remote

### Impact: Attackers can access any system files from the underlying host.

Affected components: HttpRequestHandler.java, StaticFileHandler.java

An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.

Steps to

Reproduce: 1. Start Yamcs and login as a user 2. Paste the following URL in the browser and press enter:

http://localhost:8090//etc/passwd

1. The /etc/passwd file will be downloaded.

Acknowledgements

This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.