GHSA-9jg3-g3wh-w9pj

Description

### Attack type:  Unauthenticated remote  ### Impact: Attackers can access any system files from the underlying host. ### Affected components: HttpRequestHandler.java, StaticFileHandler.java An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data. <img width="2170" height="1289" alt="image" src="https://github.com/user-attachments/assets/8d426da1-5351-4240-a290-8d858be61312" /> ## Steps to Reproduce: 1. Start Yamcs and login as a user 2. Paste the following URL in the browser and press enter: ``` http://localhost:8090//etc/passwd ``` 3. The `/etc/passwd` file will be downloaded. ## Acknowledgements This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.