An unauthenticated path traversal vulnerability in Yamcs allows remote attackers to access sensitive system and application files, posing a high risk to data confidentiality.

The vulnerability resides in the StaticFileHandler.locateFile method, which fails to properly normalize file paths. An unauthenticated attacker can supply crafted input containing traversal sequences to bypass the intended web root and access arbitrary files on the host system.

Successful exploitation of this vulnerability leads to unauthorized disclosure of sensitive host information, including configuration files, credentials, or application data. Given the CVSS score of 7.5, this high-severity flaw represents a significant risk to the integrity and confidentiality of the mission control environment, potentially facilitating further lateral movement or system compromise.

Immediate Action: Upgrade the Yamcs core components to version 5.12.0 or later immediately to incorporate the necessary path validation logic.

Proactive Monitoring: Review web access logs for requests containing suspicious path traversal patterns, such as sequences of dot-dot-slash characters, targeting the static file handler.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block or normalize directory traversal sequences in incoming HTTP requests as an interim protective measure.

Public Exploit Available: No

Organizations utilizing the Yamcs mission control framework must prioritize upgrading to the latest patched versions to eliminate this exposure. Because this vulnerability allows for unauthenticated data exfiltration, failure to apply the update leaves the host operating system and application environment vulnerable to unauthorized access.