Secure Risesoft-y9 v9.6.11 Against Unauthenticated File Write Vulnerability

Attackers exploiting CVE-2026-110116 can write arbitrary files to a Risesoft-y9 server, potentially achieving remote code execution. This capability is available to unauthenticated adversaries, meaning no login credentials are required to initiate the attack sequence. The vulnerability exists in the fileManager storeFile endpoint of the digital infrastructure platform.

The flaw allows remote actors to send crafted HTTP POST requests to the /rest/storeFile endpoint. By manipulating the fullPath and fileName parameters within these requests, attackers can create new files or overwrite existing ones that the service account has permission to modify. This arbitrary file write capability is the primary mechanism for the potential code execution outcome.

Scope of the vulnerability

The issue impacts Risesoft-y9 Digital-Infrastructure versions 9.6.5, 9.6.6, 9.6.7, 9.6.8, 9.6.9, 9.6.10, and 9.6.11. According to the National Vulnerability Database record, the vulnerability is classified under CWE-22, which denotes Improper Limitation of a Pathname to a Restricted Directory. The CVSS base score is 8.8, categorizing the severity as High.

Organizations running any version within the 9.6.5 to 9.6.11 range are exposed. The NVD record does not specify if earlier versions are affected, nor does it confirm the status of versions beyond 9.6.11. Small-business owners using this specific digital infrastructure solution should verify their installed version immediately.

What made it possible

Path traversal weaknesses typically arise when software fails to properly validate user-supplied input for directory navigation characters. In this class of event, the application accepts a file path without restricting it to a safe directory. Attackers exploit this by including sequences like "../" to move up the directory tree. This technique serves the file manipulation stage of an intrusion, allowing adversaries to place or modify files in locations the developer did not intend. Teams usually mitigate this by enforcing strict allow-lists for permitted directories and stripping special characters from path inputs.

What to watch

Monitor server logs for unusual POST requests to the /rest/storeFile endpoint, particularly those containing unexpected file paths or names. Watch for new files appearing in system directories where the Risesoft-y9 service account has write permissions. Security teams should also look for signs of remote code execution, such as unexpected processes or outbound network connections from the server.

What to do and how to stay safe: Risesoft-y9

• Verify the installed version of Risesoft-y9 Digital-Infrastructure to determine if it falls within the affected range of 9.6.5 to 9.6.11.
• Restrict network access to the Risesoft-y9 web endpoints, ensuring that the /rest/storeFile path is not exposed to untrusted networks or the public internet.
• Implement web application firewall rules to block HTTP POST requests to the storeFile endpoint that contain directory traversal sequences or suspicious file parameters.
• Review file integrity on the server for any unexpected new or modified files in service-writable directories, which could indicate exploitation.
• Contact the vendor for information on patches or updates that address CVE-2026-110116 once such information becomes available.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Risesoft-y9 are affected by CVE-2026-110116?

Versions 9.6.5 through 9.6.11 of Risesoft-y9 Digital-Infrastructure are affected by this vulnerability.

What is the severity rating of this vulnerability?

The vulnerability has a CVSS score of 8.8, which is rated as High severity.

Can attackers exploit this without logging in?

Yes, the NVD record states that the vulnerability allows unauthenticated attackers to write arbitrary files.