GHSA-9jg3-g3wh-w9pj

### Attack type:  Unauthenticated remote 

### Impact: Attackers can access any system files from the underlying host.

### Affected components: HttpRequestHandler.java, StaticFileHandler.java

An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.

<img width="2170" height="1289" alt="image" src="https://github.com/user-attachments/assets/8d426da1-5351-4240-a290-8d858be61312" />

## Steps to Reproduce: 1. Start Yamcs and login as a user 2. Paste the following URL in the browser and press enter:

``` http://localhost:8090//etc/passwd ```

3. The `/etc/passwd` file will be downloaded.

## Acknowledgements This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.