Path Traversal Vulnerability in Risesoft Digital-Infrastructure Products
CVE-2026-110115
8.7HIGH
What is CVE-2026-110115?
Risesoft Digital-Infrastructure versions 9.6.5 to 9.6.11 are susceptible to a path traversal flaw in the fileManager Y9FileController.retrieveFileStream handler. This vulnerability allows unauthenticated users to access sensitive files by manipulating the fullPath and fileName parameters to include directory traversal sequences. As a result, attackers can exploit the /rest/retrieveFileStream endpoint to potentially read critical configuration files, which may expose sensitive information such as database credentials, Redis, and Nacos configuration data.
Affected Version(s)
Digital-Infrastructure 9.6.5 <= 9.6.11