External risk intelligence

Yu AI Code Mother Path Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-75337

The vulnerability exists in an API endpoint (/api/static/) within a web application. Such API interfaces are typically exposed to the network to serve static resources or manage deployments, making them commonly reachable in internet-facing web application deployments.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Yu AI Code Mother's static resource interface allows anonymous attackers to access sensitive files outside of their intended directories. This path traversal flaw could potentially expose confidential information or allow unauthorized access to system files, depending on the specific configuration and data accessible through the interface. The main concern is confirming relevance and exposure.

Attackers can read unintended files.
This impacts systems that use the affected software.
Confirm if this software is in use.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending a request to a specific API endpoint that handles static resources. Since no authentication is required, an anonymous attacker can craft a malicious path to traverse directories and access sensitive files on the server, potentially leading to unauthorized data disclosure.

Accessible via network, no authentication needed.
Path traversal in static resource API.
Unauthorized file reading and disclosure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow anonymous attackers to read sensitive files on the server outside of the intended preview directory. This occurs when the application concatenates user-supplied input directly into a file path without proper sanitization.

Server files outside the preview directory.
Path traversal via API endpoint.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical path traversal vulnerability in Yu AI Code Mother's static resource interface requires immediate attention from teams managing web applications and APIs. The first step is to identify all instances of Yu AI Code Mother, determine their exposure to the network, assess their business criticality, and locate the accountable owner before planning remediation.

Ownership: Web application and API teams.
Verify: System exposure and business impact.
Action: Plan and execute remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Yu AI Code Mother?

Yu AI Code Mother is a software platform utilized for managing codebases and deployment previews. Version 4.3 specifically includes an interface designed to serve static resources, which helps developers quickly review or access build artifacts through a centralized API endpoint.

What does path traversal mean for CVE-2026-75337?

This vulnerability is classified as CWE-22, or Improper Limitation of a Pathname to a Restricted Directory. In plain English, it means the software fails to properly check user-provided file paths. Because the system does not normalize these requests, an attacker can manipulate the input to 'traverse' or move out of the intended preview folder and access other files stored elsewhere on the server.

How do attackers trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to the /api/static/ endpoint. This does not require any prior authentication or special user privileges. It is important to note that simply visiting the root of the API without adding manipulated directory traversal characters (such as sequences intended to navigate up the folder tree) will not cause the software to expose unintended files.

Why is this CVE a concern for my network?

According to Halo Surface Signal, this vulnerability is considered likely to be reachable because the /api/static/ endpoint is commonly exposed to the network to facilitate remote access to deployment resources. If your instance of Yu AI Code Mother is accessible from the internet, attackers can reach this interface directly to attempt to read sensitive system files.

How should I respond to this threat?

The priority is to locate all active deployments of Yu AI Code Mother within your environment. Verify whether these instances are exposed to the public internet or restricted to internal networks. Once you identify where the software is running, coordinate with the responsible team to assess the business impact and prepare for necessary updates or configuration changes to secure the static resource interface.

References

github.com/fangtang7/CVE/blob/main/yu-ai/YU_AI_4.3_TRAVERSAL_POC…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.