Risesoft-y9 vulnerabilities
We track 4 vulnerabilities in Risesoft-y9 products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 13, 2026.
Latest Risesoft-y9 vulnerabilities
- 9.1 Critical severity
Digital-Infrastructure: Improper Limitation of a Pathname to a Restricted Directory
Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to
- 7.5 High severity
Digital-Infrastructure: Improper Limitation of a Pathname to a Restricted Directory
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in
- 7.3 High severity
WorkFlow-Engine: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processI
- 7.3 High severity
Digital-Infrastructure: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/java/net/risesoft/util/Y9PlatformUtil.java of the component REST Authenticate Endpoint. Executing a manipulation can lead