Yamcs has Unauthenticated Directory Traversal

Attack type: 

Unauthenticated remote 

Impact:

Attackers can access any system files from the underlying host.

Affected components: HttpRequestHandler.java, StaticFileHandler.java

An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.

Steps to Reproduce:

1. Start Yamcs and login as a user
2. Paste the following URL in the browser and press enter:

http://localhost:8090//etc/passwd

3. The /etc/passwd file will be downloaded.

Acknowledgements

This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.