Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

New CVE Detected

CVE-2026-75337 – Unauthenticated Path Traversal / Arbitrary File Read – Yu AI Code Mother v4.3

Be the first to know when new zero-days emerge:

Summary

CVE-2026-75337 is a critical path traversal vulnerability (CWE-22) in the static resource interface of Yu AI Code Mother, an AI-powered code generation and one-click deployment platform built on Spring Boot. The flaw allows unauthenticated, remote attackers to read arbitrary files on the server, including application configuration and credential files, through the /api/static/{deployKey}/ endpoint. It carries a CVSS v3.1 base score of 9.8 (Critical), reflecting network exploitability, no authentication or user interaction requirements, and high impact to confidentiality, integrity, and availability.

Technical details

  • Root cause: The static resource handler builds the file path to serve by directly concatenating an attacker-controlled path segment onto the preview root directory (e.g. PREVIEW_ROOT_DIR + "/" + deployKey + resourcePath) without normalizing or validating the resulting path.
  • Missing authentication: The vulnerable endpoint does not carry the application’s @AuthCheck annotation used elsewhere in the codebase, so the AOP-based authentication layer is bypassed entirely — the route is reachable by anonymous, unauthenticated requests.
  • Trigger conditions: An attacker sends a GET request to /api/static/{deployKey}/ and appends directory traversal sequences (e.g. ../../) to the resource path to escape the intended per-deployment preview directory ({app}/tmp/code_output/{deployKey}/) and reach files elsewhere on the filesystem, such as application temp directories containing configuration or secrets files.
  • Attack vector: Network-based, requiring only a crafted HTTP GET request against the exposed application — no credentials or victim interaction needed.
  • Impact: Disclosure of sensitive files (e.g., database credentials and other secrets stored under application temp/config directories). Depending on deployment configuration (reverse proxies, containers) the reachable file scope may extend further, and disclosed credentials/config data could enable follow-on compromise of backend systems.
  • Note on exploitation constraints: Testing against embedded Tomcat 10.1 showed that the container blocks requests containing three or more ../ sequences and refuses certain URL-encoded traversal variants, but the underlying flaw remains exploitable and impact can be greater depending on the front-end/reverse proxy configuration.

Affected software

  • Yu AI Code Mother (yu-ai-code-app / yu-ai-code-mother-microservice), version v4.3
  • Deployed on Spring Boot 3.5.3 with embedded Tomcat 10.1 and JDK 21 (as observed in the analyzed build)

Severity

  • CVSS v3.1 Base Score: 9.8 (Critical)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

  • Immediate: No official vendor-published patched version has been confirmed at the time of this writing. Security teams should monitor the Yu AI Code Mother project for an updated release that adds path normalization/canonicalization and enforces authentication on the /api/static/{deployKey}/ endpoint, and upgrade as soon as a fix is available.
  • If no patch is available:
    • Restrict or disable public network exposure of the /api/static/{deployKey}/ endpoint until a fix is applied — place it behind authentication at the reverse proxy/gateway layer.
    • Configure a WAF or reverse proxy rule to block requests to this path containing traversal sequences (../, encoded variants such as %2e%2e%2f, etc.).
    • Run the application with a least-privilege filesystem context so that even if traversal succeeds, sensitive files (credentials, secrets, configuration) are not readable by the application process.
    • Avoid storing plaintext secrets (e.g., database passwords) in locations reachable from the application’s temp/output directories; use a secrets manager or environment-injected secrets instead.
    • Monitor logs for requests to /api/static/ containing directory traversal patterns as an indicator of exploitation attempts.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge