CVE-2026-10073

Executive Summary

CVE-2026-10073 is a High-severity Arbitrary File Read vulnerability residing in Interinfo's DreamMaker application, as disclosed by the TWNCERT (Taiwan National Computer Emergency Response Team) coordinator. The flaw enables unauthenticated local attackers to exploit a Relative Path Traversal flaw to download arbitrary system files from the underlying host operating system. Successful exploitation permits the exfiltration of sensitive data including configuration files, credentials, and proprietary source code, which can serve as a stepping stone for broader network compromise. All installations of DreamMaker prior to version Java Composer 2.3 are considered affected. A vendor-fix has been claimed but not independently confirmed, so organizations should treat the patch with caution, test thoroughly, and deploy compensating controls immediately.

Technical Analysis

CVE-2026-10073 is rooted in an Arbitrary File Read vulnerability classified under CWE-23: Relative Path Traversal. DreamMaker, developed by Interinfo, fails to properly sanitize user-supplied file path inputs. The flaw allows an attacker to inject relative path traversal sequences (e.g., ../../../../etc/passwd) to navigate the file system outside the intended application root. Because the vulnerability is triggered by an unauthenticated local attacker, the attack surface is the application's file-serving interface as exposed on the local network or via a web-facing deployment.

The core mechanism involves the application performing a file read operation based on a path parameter that is not adequately validated against path traversal payloads. When the application receives a request like GET /download?file=../../../../etc/shadow, it constructs an absolute path by concatenating a base directory with the user-supplied input. Without proper canonicalization or containment checks, the OS resolves the .. sequences and the application reads and returns the contents of the target file.

The vulnerability is categorized as "local" in the NVD description, which suggests the initial attack vector may require local access or the ability to reach a locally-bound service. However, in many real-world deployments, DreamMaker is embedded into web applications and exposed via a web interface, thus making the practical attack surface network-accessible.

Affected versions are those prior to Java Composer 2.3. As the product is built on a Java-based composer stack, the file read operation is likely implemented in a servlet/controller that accepts a path or filename parameter. The attack is straightforward and does not require authentication, substantially increasing the severity. The official CVSS score of 8.7 reflects the high impact of full file disclosure with relatively low attack complexity.

No public proof-of-concept code or Nuclei templates are currently documented. However, the vulnerability class is well-understood, and weaponized exploits for path traversal file-read flaws are commonplace in offensive tooling such as Metasploit, Burp Suite extensions, and custom scripts.

Exploitation Scenarios

A realistic exploitation chain for CVE-2026-10073 is as follows:

1. Reconnaissance and Target Identification:

   • An attacker identifies a DreamMaker instance by fingerprinting the application's default landing page, HTTP response headers (e.g., Server: DreamMaker), or common path patterns like /dreammaker/ or /composer/.
   • Network scanning with tools like Nmap or Shodan can enumerate exposed web services on ports 80, 443, 8080, or 8443 that match DreamMaker's UI.

2. Weaponization and Trigger:

   • The attacker crafts an HTTP GET request to a known or fuzzed file-serving endpoint. Likely endpoints include /download, /file, /read, /getFile, or /api/read.
   • The request exploits the insecure parameter: GET /download?file=../../../../../../etc/passwd or GET /read?path=..%2f..%2f..%2f..%2fetc%2fshadow.
   • URL-encoded traversal payloads (%2e%2e%2f) are used where the application decodes input prior to file access.

3. Payload Execution:

   • The application resolves the traversal sequence and reads the target file from the host filesystem.
   • The response body contains the contents of /etc/passwd, /etc/shadow, or, on Windows systems, C:\Windows\win.ini or C:\inetpub\wwwroot\web.config.

4. Post-Exploitation Impact:

   • The attacker harvests credential material (e.g., hashed passwords), database connection strings, application source code, and private keys stored on the server.
   • With stolen credentials, the attacker gains authenticated access to adjacent systems, potentially pivoting to database servers or internal administrative panels.
   • The attacker may exfiltrate sensitive business data and PII, causing regulatory and reputational damage.

This attack is trivially automatable with a simple script iterating over a wordlist of interesting files (e.g., /etc/passwd, /proc/self/environ, /opt/dreammaker/application.properties). Even without public PoC, the technique is well-documented and within the skill range of script-kiddie to intermediate attackers.

Impact Assessment

The impact of CVE-2026-10073 is severe, reflected in a CVSS v3.1 score of 8.7 (High). The vulnerability breaks the confidentiality of the underlying system entirely, allowing an unauthenticated attacker to read any file the application process account can access. This includes:

• Configuration files: Database credentials, API keys, JWT secrets, and SMTP credentials.
• Source code: Proprietary business logic stored in JAR, WAR, or properties files, enabling further reverse-engineering attacks.
• User data: Application-generated customer records, session tokens, and audit logs.
• OS-level secrets: Passwd/shadow files for OS user enumeration and potential password cracking.

The confidentiality impact is rated as High. The integrity and availability impacts are likely None, as the flaw is read-only. However, the blast radius is broad: any system running DreamMaker pre-2.3 is exposed. If DreamMaker is used as a central management console for other Interinfo products, the compromise of this system can lead to a full enterprise-wide takeover through credential theft.

From an enterprise risk perspective, this vulnerability sits at the intersection of unauthorized data disclosure and lateral movement preparation. The lack of authentication and trivial exploitation complexity makes it a high-priority candidate for patching, even though there is currently no evidence of exploitation in the wild.

Detection Guidance

Sigma Rule

title: CVE-2026-10073 - DreamMaker Arbitrary File Read via Relative Path Traversal
id: 9a8f9e1c-6b7a-4f2e-9a3c-2c1d4e5f6a7b
status: experimental
description: Detects HTTP GET requests to DreamMaker endpoints with traversal sequences indicating CVE-2026-10073 exploitation.
logsource:
  category: webserver
  product: null
detection:
  selection:
    http.method: 'GET'
    http.url|contains|all:
      - 'download'
      - '..'
    http.url|contains|any:
      - '%2e%2e%2f'
      - '../../'
      - '..%5c'
  condition: selection
fields:
  - http.url
  - http.status_code
  - http.response.bytes
  - src.ip
falsepositives:
  - Legitimate application usage with odd file names
level: high

YARA Rule

rule CVE_2026_10073_DreamMaker_Path_Traversal {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects path traversal payloads in HTTP requests targeting DreamMaker file-read endpoints"
        cve = "CVE-2026-10073"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "/download?file=" ascii nocase
        $s2 = "/read?path=" ascii nocase
        $s3 = "/getFile?filename=" ascii nocase
        $t1 = "..\\" ascii
        $t2 = "../" ascii
        $t3 = "%2e%2e%2f" ascii
        $t4 = "%2e%2e%5c" ascii
    condition:
        any of ($s*) and any of ($t*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-10073 - DreamMaker Arbitrary File Read Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/download"; http_uri; content:"file="; http_uri; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c)/i"; sid:202610073; rev:1; classtype:attempted-recon; reference:cve,2026-10073;)

Elastic Detection

sequence by source.ip, destination.ip, destination.port with maxspan=5s
  [ network where event.action == "connection_established" and destination.port in (80, 443, 8080, 8443) ]
  [ http where event.action == "request" and http.request.method == "GET" and
      (wildcard(http.request.uri, "*/download?file=*") or wildcard(http.request.uri, "*/read?path=*")) and
      (wildcard(http.request.uri, "*../*") or wildcard(http.request.uri, "*%2e%2e%2f*") or wildcard(http.request.uri, "*..\\*"))
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="GET" AND (uri_path LIKE "%download%" OR uri_path LIKE "%read%") AND (uri LIKE "%..%2f%" OR uri LIKE "%..%2f%" OR uri LIKE "%../%" OR uri LIKE "%..\\%")
| stats count by src_ip, uri, status, user_agent

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="100973" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.download\?file=</field>
    <field name="url">\.\./|\.\.\\|%2e%2e%2f</field>
    <description>CVE-2026-10073 - DreamMaker Arbitrary File Read attempt detected.</description>
    <group>pci_dss_6.5.1,gpg13_7.9,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (If Patch Unavailable or Untested):

   • Restrict access to DreamMaker's web interface using network-level access control lists (ACLs). Only allow connections from trusted administrative networks or VPN IP ranges.
   • Deploy a Web Application Firewall (WAF) with rules to block path traversal signatures, specifically blocking ..%2f, %2e%2e%2f, ..\\, and similar patterns in request URIs.
   • If the vulnerable endpoint is not business-critical, disable it completely via reverse proxy configuration or application settings.

2. Patch/Upgrade Steps:

   • The vendor (Interinfo) has claimed a fix in version Java Composer 2.3. Download the update from the official vendor portal after verifying its integrity with SHA-256 checksums.
   • Before production deployment, test the update in a non-production environment. Validate that the file-read endpoint now rejects traversal payloads and that normal application functionality is unaffected.
   • After upgrading, confirm the current running version matches 2.3 or later via the application's version page or release notes.

3. Long-Term Hardening:

   • Apply the principle of least privilege to the OS account under which the DreamMaker application runs. Restrict file system access to only the directories required for normal operation.
   • Conduct a security code review of all file-handling endpoints within DreamMaker to identify similar traversal flaws.
   • Implement a robust web application security testing (SAST/DAST) pipeline in the CI/CD lifecycle to catch such flaws before deployment.
   • Maintain an up-to-date inventory of all assets running DreamMaker to expedite future patching efforts.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-10073 (note: verify in NVD once published)
• TWNCERT Advisory: https://www.twcert.org.tw/ (search for CVE-2026-10073 advisory)
• Vendor Advisory (Interinfo): https://www.interinfo.com.tw/ (patch release notes for Java Composer 2.3)
• CWE-23 Reference: https://cwe.mitre.org/data/definitions/23.html
• CISA KEV: Not listed (no known exploitation in the wild as of the report date).