CVE-2026-10075
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
In DreamMaker by Interinfo, a Path Traversal vulnerability allows unauthenticated remote attackers to read file names under arbitrary paths via Absolute Path Traversal.
Risk Assessment
The attack can reveal directory structure and file names, which may aid further attacks.
Recommendation
Apply the patch provided by the vendor or upgrade DreamMaker to a newer version.
Other vulnerabilities in DreamMaker
See all- CVE-2026-10071Critical
DreamMaker by Interinfo has an arbitrary file upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server.
- CVE-2026-10074Medium
DreamMaker by Interinfo has an Arbitrary File Read vulnerability, allowing privileged local attackers to exploit Relative Path Traversal to download arbitrary system files.
- CVE-2026-10073High
A vulnerability in DreamMaker by Interinfo allows unauthenticated local attackers to read arbitrary system files via Relative Path Traversal.
- CVE-2026-10072High
DreamMaker by Interinfo has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server.
Original NVD description (English source)
DreamMaker developed by Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to read file names under arbitrary path by exploiting an Absolute Path Traversal vulnerability.