Yamcs exposes an unauthenticated directory traversal flaw in the StaticFileHandler, allowing an attacker to craft a request path that bypasses the configured web root. The flaw permits reading any file on the host operating system, potentially leaking sensitive OS data or application files. This vulnerability directly compromises confidentiality by exposing arbitrary host files without authentication and can reveal system configurations, credentials, or code that may lead to further exploitation.

Yamcs mission control framework versions prior to 5.11.13, and the 5.12 branch before 5.12.0, are affected.

The CVSS score of 7.5 indicates a high severity risk and the flaw has no authentication requirement, implying a high likelihood of exploitation over the network. EPSS data is not available, and the vulnerability is not listed in CISA KEV, but the lack of EPSS does not diminish the high impact potential. The evidenced exploitation path is simple: unauthenticated HTTP request to the server with a crafted path containing traversal segments.