Path Traversal Vulnerability in Yamcs Mission Control Framework
CVE-2026-55552

7.5HIGH

Key Information:

Vendor

Yamcs

Status
Yamcs
Vendor
CVE Published:
28 August 2026

What is CVE-2026-55552?

The Yamcs mission control framework contains a vulnerability in which the StaticFileHandler incorrectly resolves unauthenticated request paths. This misconfiguration allows for path traversal, enabling attackers to escape the designated web root and potentially access sensitive host files on the operating system and applications. This vulnerability has implications for data security and privacy, as it can lead to unauthorized data exposure. The issue has been addressed and resolved in version 5.11.13 and in the subsequent 5.12.0 release.

Affected Version(s)

yamcs < 5.12.0

References

https://github.com/yamcs/yamcs/security/advisories/GHSA-9...
x_refsource_CONFIRM
https://github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c2...
x_refsource_MISC
https://github.com/yamcs/yamcs/commit/f4bc588880c166849e9...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.