CVE-2026-75337
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The static resource interface /api/static/{deployKey}/ in Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without normalization, allowing anonymous attackers to read files outside the preview root.
Risk Assessment
An anonymous attacker can read arbitrary files from the system, including configuration files, credentials, or other sensitive information.
Recommendation
Normalize input paths and ensure they do not escape the allowed directory, and add input validation for the path parameter.
Original NVD description (English source)
The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root.