Key points
- CVE-2026-110116 affects Risesoft-y9 Digital-Infrastructure versions 9.6.5 through 9.6.11.
- The National Vulnerability Database rates the flaw as high severity with a CVSS score of 8.8.
- Attackers can exploit the fileManager storeFile endpoint without authentication to write files.
Unauthenticated attackers can exploit a path traversal vulnerability in Risesoft-y9 Digital-Infrastructure to write arbitrary files to affected systems. The flaw, identified as CVE-2026-110116, exists in the fileManager storeFile endpoint. According to the National Vulnerability Database, this weakness allows remote attackers to create or overwrite service-writable files. Successful exploitation could potentially lead to remote code execution on the targeted infrastructure.
By the numbers
- CVSS 8.8: The high severity score assigned by the National Vulnerability Database for this vulnerability.
- CWE-22: The Common Weakness Enumeration identifier for the path traversal weakness underlying the issue.
- 9.6.5-9.6.11: The specific version range of Risesoft-y9 Digital-Infrastructure confirmed to be affected.
What the figures mean
The National Vulnerability Database lists CVE-2026-110116 as affecting Risesoft-y9 Digital-Infrastructure versions 9.6.5 through 9.6.11. The assigned CVSS score of 8.8 classifies the issue as high severity. This rating reflects the ease with which unauthenticated attackers can exploit the flaw. The vulnerability stems from improper input validation in the fileManager storeFile endpoint. Attackers can manipulate the fullPath and fileName parameters in POST requests to /rest/storeFile. This manipulation allows them to specify locations outside the intended directory structure. Consequently, they can write files to any location the service account can access.
What to watch
Security teams should monitor for unauthorized file creation or modification on systems running affected Risesoft-y9 versions. The ability to overwrite service-writable files indicates a significant risk to system integrity. Analysts should inspect web server logs for unusual POST requests to the /rest/storeFile endpoint. Specifically, look for requests containing crafted fullPath or fileName parameters that attempt to traverse directory boundaries. Any such activity may indicate an attempt to exploit CVE-2026-110116. Organizations must remain vigilant for signs of active exploitation or subsequent code execution attempts.
Infection and persistence in general
Teams usually investigate path traversal incidents by reviewing web server access logs for unusual request patterns. Analysts should check whether attackers successfully wrote files to unexpected directories. Persistence often involves placing executable scripts or web shells in accessible locations. Spread typically occurs when the attacker leverages the initial foothold to move laterally. Organizations should examine file system integrity monitoring alerts for new or modified files. Reviewing service account permissions helps determine the scope of potential damage. Identifying the specific files created or overwritten is crucial for containment and remediation efforts.
Background: Path traversal vulnerabilities
Path traversal attacks exploit how applications combine user input with file system paths. Input sanitization alone fails because encoding tricks and OS-specific parsing rules bypass simple checks. You must use canonical path resolution and strict allowlists to verify that the final resolved path remains within the intended directory.
Read the full guide: Path Traversal Myths: Why File Validation Fails and How to Fix It
What to do and how to stay safe: Risesoft-y9
- Verify if your environment runs Risesoft-y9 Digital-Infrastructure versions 9.6.5 through 9.6.11.
- Monitor web server logs for suspicious POST requests to the /rest/storeFile endpoint.
- Restrict network access to the fileManager endpoint to trusted sources only.
- Watch for unauthorized file changes or new executable files on affected systems.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Risesoft-y9 are affected by CVE-2026-110116?
Versions 9.6.5 through 9.6.11 of Risesoft-y9 Digital-Infrastructure are affected by this vulnerability.
What is the severity of this path traversal flaw?
The National Vulnerability Database rates it as high severity with a CVSS score of 8.8.
Can attackers exploit this flaw without authentication?
Yes, the vulnerability allows unauthenticated attackers to write arbitrary files to the system.
