CVE-2026-10073
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability in DreamMaker by Interinfo allows unauthenticated local attackers to read arbitrary system files via Relative Path Traversal.
Risk Assessment
Attackers can access sensitive system data such as configuration files, passwords, or keys, leading to confidentiality and integrity breaches.
Recommendation
Immediately update DreamMaker to the latest version from the vendor and implement file path validation mechanisms to prevent traversal.
Other vulnerabilities in DreamMaker
See all- CVE-2026-10071Critical
DreamMaker by Interinfo has an arbitrary file upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server.
- CVE-2026-85541Medium
DreamMaker by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript in a user's browser via a malicious website.
- CVE-2026-85540High
DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.
- CVE-2026-10075Medium
In DreamMaker by Interinfo, a Path Traversal vulnerability allows unauthenticated remote attackers to read file names under arbitrary paths via Absolute Path Traversal.
- CVE-2026-10074Medium
DreamMaker by Interinfo has an Arbitrary File Read vulnerability, allowing privileged local attackers to exploit Relative Path Traversal to download arbitrary system files.
- CVE-2026-10072High
DreamMaker by Interinfo has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server.
Original NVD description (English source)
DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing unauthenticated local attackers to exploit Relative Path Traversal to download arbitrary system files.