Yamcs exposes an unauthenticated directory traversal flaw in the StaticFileHandler, allowing an attacker to craft a request path that bypasses the configured web root. The flaw permits reading any file on the host operating system, potentially leaking sensitive OS data or application files. This vulnerability directly compromises confidentiality by exposing arbitrary host files without authentication and can reveal system configurations, credentials, or code that may lead to further exploitation.

Yamcs mission control framework versions prior to 5.11.13, and the 5.12 branch before 5.12.0, are affected.

The CVSS score of 7.5 indicates a high severity risk and the flaw has no authentication requirement, implying a high likelihood of exploitation over the network. The EPSS score of 2% suggests that the vulnerability is expected to be exploited with a modest probability, while the lack of listing in CISA KEV does not diminish the high impact potential. The evidenced exploitation path is simple: unauthenticated HTTP request to the server with a crafted path containing traversal segments.