CVE-2026-110115

HighCVSS 7.5

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

36th percentile - higher than 36% of all known CVEs

Summary

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler. Unauthenticated attackers can read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters, retrieving files like application.yml and exposing database, Redis, and Nacos credentials.

Risk Assessment

Exposure of critical credentials may allow attackers to access internal systems such as databases, Redis, and Nacos, potentially leading to full infrastructure compromise.

Recommendation

Immediately update Risesoft Digital-Infrastructure to a version later than 9.6.11 if available, or apply patches to fix the path traversal. Also rotate all exposed credentials and conduct a security audit.

Other vulnerabilities in Risesoft Digital-Infrastructure

CVE-2026-111651Medium
Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.

Original NVD description (English source)

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS