A path traversal flaw in the Y9FileController.retrieveFileStream handler allows any network user to supply parent-directory segments in the fullPath and fileName parameters, enabling the unauthenticated /rest/retrieveFileStream endpoint to read arbitrary files. By requesting paths such as application.yml, an attacker can obtain database, Redis, and Nacos credentials, granting high-value information without authentication. This vulnerability exposes sensitive configuration data and potentially facilitates further attacks depending on the information leaked.

The flaw affects Risesoft's Digital-Infrastructure product, specifically versions 9.6.5 through 9.6.11. These releases expose the vulnerable file manager endpoint and do not contain the patch that removes the traversal issue.

The CVSS score of 8.7 indicates a high severity level. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the flaw by sending an unauthenticated HTTP request to the /rest/retrieveFileStream endpoint with crafted parameters, allowing them to read arbitrary files owned by the application process.