Update Risesoft-y9 to Stop Unauthenticated File Writes and Prevent Remote Code Execution
A high-severity flaw in Risesoft-y9 lets anyone write files without logging in, risking full system control through code execution.
Key points
- Risesoft-y9 versions 9.6.5 through 9.6.11 contain a path traversal vulnerability rated 8.8 high severity.
- Attackers can use the fileManager endpoint to write arbitrary files without authentication.
- Successful exploitation may allow remote code execution on affected systems.
Risesoft-y9 Digital-Infrastructure has a security hole that lets strangers write files to your server without a password. This flaw affects versions 9.6.5 through 9.6.11. The National Vulnerability Database rates the issue as high severity. Attackers do not need to log in to exploit it. They can target the fileManager component directly. This creates a serious risk for system administrators.
In plain English
The problem lies in how the software handles file requests. A feature called storeFile accepts instructions on where to save data. The code does not check if those instructions try to escape the intended folder. This is known as path traversal. An attacker can trick the system into saving a file anywhere the service has permission. This includes critical system directories.
The background
The vulnerability is tracked as CVE-2026-110116. It involves the CWE-22 weakness class. The specific entry point is the POST /rest/storeFile endpoint. Attackers send crafted parameters named fullPath and fileName. These parameters tell the server where to write the data. The server trusts these inputs too much. It processes the request without verifying the path safety. This allows the creation or overwriting of service-writable files.
What changes now
Administrators must verify their Risesoft-y9 version immediately. If you run version 9.6.5, 9.6.6, 9.6.7, 9.6.8, 9.6.9, 9.6.10, or 9.6.11, you are affected. The National Vulnerability Database records this as a high-severity issue. The CVSS score is 8.8. This score reflects the ease of exploitation. No authentication is required. The potential impact includes remote code execution.
Key terms explained
Path traversal happens when software fails to restrict file access to a specific folder. Attackers use special characters to move up the directory tree. Unauthenticated means no login is needed to perform the action. Remote code execution allows an attacker to run commands on the server. Teams usually check input validation to prevent these issues. Verify that file paths are sanitized. Ensure services run with minimal permissions. This limits the damage if a file write succeeds.
What to do and how to stay safe: Risesoft-y9
- Check your Risesoft-y9 version to see if it falls between 9.6.5 and 9.6.11.
- Review server logs for unusual POST requests to the /rest/storeFile endpoint.
- Restrict network access to the fileManager endpoint if possible.
- Monitor for new files created in system directories by unauthorized users.
Step-by-step guide: Risk-Based Vulnerability Management: Benefits, Limits, and Reality
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Risesoft-y9 versions are affected by this vulnerability?
Versions 9.6.5 through 9.6.11 of Risesoft-y9 Digital-Infrastructure are affected.
Do attackers need a password to exploit this flaw?
No, the vulnerability allows unauthenticated access, meaning no login is required.
What is the potential impact of this vulnerability?
Attackers can write arbitrary files, potentially achieving remote code execution on the server.
