CVE-2026-110116

{
  "etk_id": "ETK-2026-1485",
  "cve_id": "CVE-2026-110116",
  "display_id": "CVE-2026-110116",
  "ghsa_id": "GHSA-384w-qhxp-j99v",
  "euvd_id": "EUVD-2026-98947",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated path traversal in Digital-Infrastructure",
  "summary": "Digital-Infrastructure versions 9.6.5 through 9.6.11 are affected by a path traversal flaw in the file storage endpoint. An unauthenticated remote attacker may write or overwrite files in locations writable by the service, which could lead to code execution. Exposure requires the affected endpoint to be network-accessible.",
  "mitigation": "Restrict network access to the affected file storage endpoint, allowing only trusted clients, and disable it if it is not required. No fixed version is recorded; monitor vendor updates and upgrade when a corrected release is available.",
  "vendor": "risesoft-y9",
  "product": "Digital-Infrastructure",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 9.6.5, <= 9.6.11"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Digital-Infrastructure",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0059,
  "epss_percentile": 0.4733,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 39.24330476666667,
  "t0_at": "2026-10-13T16:53:14.032000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-13T18:03:35.305512+00:00",
      "days": 0.048857332314814816,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T16:53:14.032000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-13T16:53:14.032000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T16:53:14.032000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110116"
    }
  }
}