Key points
- Risesoft-y9 Digital-Infrastructure versions 9.6.5 through 9.6.11 are affected by CVE-2026-110116.
- The vulnerability allows unauthenticated attackers to write or overwrite files via crafted parameters.
- No patch or fix has been confirmed by the vendor for this high-severity issue.
Risesoft-y9 Digital-Infrastructure versions 9.6.5 through 9.6.11 contain a high-severity path traversal vulnerability. Security researchers have identified that unauthenticated attackers can exploit this flaw to write arbitrary files to the server.
What happened
The National Vulnerability Database record for CVE-2026-110116 describes a flaw in the fileManager storeFile endpoint. Attackers can send crafted fullPath and fileName parameters to the POST /rest/storeFile route. This allows them to create or overwrite files that the service account can write to. The weakness is classified under CWE-22, indicating improper limitation of a pathname to a restricted directory. The flaw affects all versions from 9.6.5 up to and including 9.6.11.
Why it matters
The CVSS score for this issue is 8.8, which rates it as high severity. The primary risk is that attackers can write arbitrary files without needing authentication. If an attacker can overwrite a service-writable file, they may achieve remote code execution. This means an external threat actor could potentially take control of the affected infrastructure. The lack of authentication requirements makes the attack surface significantly larger for exposed systems.
What happens next
- Check your inventory for Risesoft-y9 Digital-Infrastructure versions 9.6.5 through 9.6.11.
- Verify if the POST /rest/storeFile endpoint is accessible from external networks.
- Monitor logs for unusual file creation or modification attempts on the server.
- Await official guidance or patches from the vendor to remediate the issue.
Patch priority
Organisations should prioritise systems exposed to the internet or untrusted networks. Teams usually isolate affected instances from external traffic while waiting for a vendor update. Check whether the fileManager endpoint is accessible to unauthenticated users. Back up configuration files and critical data before making any network changes. Reduce exposure by restricting access to the specific REST endpoint using firewall rules. Test any temporary mitigations in a non-production environment first. Ensure monitoring alerts are active for suspicious file activity on the server.
What to do and how to stay safe: Risesoft-y9
- Restrict network access to the POST /rest/storeFile endpoint to trusted internal IPs only.
- Monitor server logs for unusual file creation or overwrite attempts by unauthenticated users.
- Isolate affected Risesoft-y9 instances from external networks until a vendor fix is available.
- Verify that service accounts running the application have minimal file write permissions.
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Risesoft-y9 are affected by CVE-2026-110116?
Versions 9.6.5 through 9.6.11 of Risesoft-y9 Digital-Infrastructure are affected by this vulnerability.
Is there a patch available for this path traversal flaw?
No fix has been confirmed yet by the vendor for this high-severity issue.
What is the primary risk of this vulnerability?
Unauthenticated attackers can write arbitrary files, potentially achieving remote code execution.
