The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 28 Aug 2026 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Yu AI Code Mother 4.3 Static Resource Path Traversal | |
| Weaknesses | CWE-22 |
Thu, 27 Aug 2026 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root. | |
| References |
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-08-27T20:50:10.871Z
Reserved: 2026-08-17T00:00:00.000Z
Link: CVE-2026-75337
No data.
Status : Received
Published: 2026-08-28T00:18:12.150
Modified: 2026-08-28T00:18:12.150
Link: CVE-2026-75337
No data.
OpenCVE Enrichment
Updated: 2026-08-28T08:30:17Z
Weaknesses