CVE-2026-75337
The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root di…
Published: 2026-08-27 · CVSS: 9.8 · CVSS 3.1
The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7