CVE-2026-10074

Executive Summary

CVE-2026-10074 is an Arbitrary File Read vulnerability in DreamMaker, a web application framework developed by Interinfo (Taiwan). The flaw permits a privileged local attacker to exploit a Relative Path Traversal (CWE-23) condition to download arbitrary system files from the underlying host. With a CVSS score of 6.9 (Medium severity), the vulnerability affects all DreamMaker versions prior to Java Composer 2.3, which is the patched release. Organizations running DreamMaker-based applications should prioritize upgrading to Java Composer 2.3 or later, as no workarounds are currently available.

Technical Analysis

The vulnerability resides in DreamMaker's file-serving and request-handling logic. DreamMaker, a low-code development platform commonly used for enterprise application delivery in the Asia-Pacific region, exposes a set of privileged administrative endpoints. When handling file download requests, the application fails to adequately sanitize user-supplied path parameters, allowing traversal sequences such as ../ to escape the intended application-accessible directory.

Vulnerability Mechanism:

The core issue is a classic Relative Path Traversal (CWE-23) flaw. The application constructs file paths by concatenating a base directory with user-controlled input without performing canonicalization checks or enforcing path containment. Specifically, the vulnerable endpoint receives a filename or path parameter, resolves it relative to a web-accessible directory (e.g., /opt/dreammaker/webapps/uploads/), and streams the file contents back to the caller. By injecting ../../../../etc/passwd into the path parameter, an attacker can traverse outside the intended directory and read arbitrary files.

Attack Surface:

The attack surface is limited to local, privileged attackers. The vulnerable functionality is exposed only to authenticated users with elevated privileges (e.g., application administrators or OS users with access to the DreamMaker management console). This reduces the remote exploitability but does not diminish the severity of the information disclosure — a compromised or malicious admin can exfiltrate highly sensitive system files (e.g., /etc/shadow, application configuration files, cryptographic keys, database credentials).

Code-Level Explanation:

While the full source code is proprietary, the vulnerability pattern is consistent with the following pseudocode:

// DreamMaker Java Composer — file download endpoint
@GET
@Path("/file/download")
public Response downloadFile(@QueryParam("path") String relativePath) {
    String baseDir = "/opt/dreammaker/webapps/uploads/";
    String fullPath = baseDir + relativePath; // NO canonicalization or traversal check
    File file = new File(fullPath);
    return Response.ok(file).build(); // streams file contents
}

The absence of Path.normalize(), getCanonicalPath() validation, or a whitelist of allowed extensions/directories enables traversal beyond baseDir.

Additional Considerations:

• The vulnerability is confirmed by the CNA (twcert) with a patch confidence rating of 2/4, meaning the patch existence is claimed by a single source and not independently verified.
• No public exploit code or Nuclei templates exist at the time of this report, indicating the vulnerability is not yet weaponized in public tooling.
• EPSS score of 0.00347 (27.4th percentile) suggests a low probability of exploitation in the wild, but this metric can change rapidly upon public disclosure.

Exploitation Scenarios

Scenario: Privileged Local Attacker Exfiltrating Sensitive System Files

Step 1 — Reconnaissance and Target Identification

The attacker first gains access to the DreamMaker management interface. This could be achieved through:

• Compromising an administrative account via phishing or credential stuffing.
• Leveraging a separate vulnerability to escalate privileges on the host.
• Insider threat: a legitimate low-privilege user discovers that an administrative role is required.

Once authenticated, the attacker identifies the file download functionality — typically accessible via a menu item like "System Tools > File Manager" or a direct URL pattern such as https://target:8080/dreammaker/api/file/download?path=.

Step 2 — Path Traversal Trigger

The attacker crafts a request to the vulnerable endpoint with traversal payloads. Using a web proxy (e.g., Burp Suite) or a simple curl command, the attacker sends:

curl -k -X GET \
  "https://target:8080/dreammaker/api/file/download?path=../../../../../etc/shadow" \
  -H "Authorization: Bearer <admin_jwt_token>"

The application resolves the path as /opt/dreammaker/webapps/uploads/../../../../../etc/shadow, which normalizes to /etc/shadow.

Step 3 — Payload Validation and File Discovery

The attacker validates the vulnerability with a low-sensitivity file first:

curl -k -X GET "https://target:8080/dreammaker/api/file/download?path=../../../etc/hostname"

Upon confirming the response contains the hostname, the attacker proceeds to enumerate critical files:

• /etc/passwd — user account enumeration.
• /etc/shadow — password hashes.
• /opt/dreammaker/config/application.properties — database credentials, API keys.
• /root/.ssh/id_rsa — SSH private keys.
• /proc/self/environ — environment variables with secrets.

Step 4 — Post-Exploitation and Lateral Movement

With access to configuration files and password hashes, the attacker can:

• Crack password hashes offline using john or hashcat.
• Use extracted database credentials to access backend databases.
• Leverage SSH private keys for lateral movement across the network.
• Disable logging and maintain persistence.

Parenthetical note: While this attack requires a privileged local account, the impact of arbitrary file disclosure at this privilege level often leads to full host compromise and domain-wide escalation, significantly increasing the effective severity beyond the CVSS vector score.

Impact Assessment

The CVSS v3.1 score of 6.9 (Medium) is calculated with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating:

• Confidentiality Impact: High — Arbitrary file read exposes system secrets, credentials, and sensitive data.
• Integrity Impact: High — While the primary flaw is a file read, at this privilege level, adjacent functionality may allow file modification, and the disclosed credentials can enable integrity violations on other systems.
• Availability Impact: High — Full system compromise may result in denial of service to the DreamMaker application and underlying infrastructure.

Business Impact:

• Data Breach Risk: Exposure of application.properties and similar files can reveal database credentials, encryption keys, and third-party API tokens, enabling broader data exfiltration.
• Regulatory Exposure: Organizations handling regulated data (PII, PHI, PCI) may face compliance violations and fines if sensitive files are disclosed.
• Supply Chain Risk: DreamMaker is a development platform; compromised hosts may allow malicious code injection into applications built on the framework, affecting downstream customers.

Blast Radius: The affected system (single DreamMaker instance) and, through credential disclosure, the entire network segment containing the host and its connected databases and services.

Detection Guidance

Sigma Rule

title: CVE-2026-10074 - DreamMaker Arbitrary File Read via Path Traversal
id: 5f8a3c9e-1b2d-4e6f-8a7b-3c9d2e4f6a8b
status: experimental
description: Detects attempts to exploit CVE-2026-10074, a relative path traversal in DreamMaker's file download endpoint.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-10074
author: Valtersit Threat Intelligence
date: 2026/01/15
tags:
    - attack.t1083
    - cve.2026.10074
logsource:
    category: webserver
    product: apache
    definition: 'Requires access logs or WAF logs for DreamMaker application endpoints.'
detection:
    selection_path_traversal:
        cs-method: 'GET'
        cs-uri-stem:
            - '/dreammaker/api/file/download'
            - '/api/file/download'
        cs-uri-query|contains:
            - 'path=..%2f'
            - 'path=../'
            - 'path=....//'
            - 'path=%2e%2e%2f'
            - 'path=%252e%252e%252f'
        cs-uri-query|re:
            - 'path=(\.\./){2,}'
            - 'path=(%2e%2e%2f){2,}'
    selection_sensitive_files:
        cs-uri-query|contains:
            - 'etc/passwd'
            - 'etc/shadow'
            - 'application.properties'
            - 'id_rsa'
            - 'id_dsa'
            - '.ssh'
            - 'web.xml'
    condition: selection_path_traversal or selection_sensitive_files
falsepositives:
    - Legitimate administrative requests for files within the uploads directory
level: high

YARA Rule

rule CVE_2026_10074_DreamMaker_PathTraversal
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects path traversal patterns targeting DreamMaker file download endpoints"
        cve = "CVE-2026-10074"
        date = "2026-01-15"
        severity = "medium"
    strings:
        $endpoint1 = "/dreammaker/api/file/download" ascii nocase
        $endpoint2 = "/api/file/download" ascii nocase
        $traversal1 = "/../" ascii
        $traversal2 = "..%2f" ascii nocase
        $traversal3 = "%2e%2e%2f" ascii nocase
        $sensitive1 = ".ssh" ascii nocase
        $sensitive2 = "etc/passwd" ascii nocase
        $sensitive3 = "etc/shadow" ascii nocase
        $sensitive4 = "application.properties" ascii nocase
        $sensitive5 = "web.config" ascii nocase
        $param = "path=" ascii nocase
    condition:
        (
            uint16(0) == 0x0D0A or
            uint32(0) == 0x0A0D0A0D or
            uint32(0) == 0x47455420  // "GET "
        ) and
        any of ($endpoint*) and
        any of ($traversal*) and
        $param and
        any of ($sensitive*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-10074 - DreamMaker Arbitrary File Read via Path Traversal";
    flow:established,to_server;
    http.method:"GET";
    http.uri;
    content:"/file/download";
    http.uri;
    content:"path=";
    pcre:"/path=(?:\.\.\/|%2e%2e%2f|\.\.%2f){2,}/Ui";
    pcre:"/path=.*(?:etc\/passwd|etc\/shadow|application\.properties|id_rsa|\.ssh|web\.xml|config\.php)/Ui";
    classtype:attempted-user;
    reference:cve,2026-10074;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-10074;
    sid:202610074001;
    rev:1;
    metadata:created_at 2026-01-15, updated_at 2026-01-15;
)

Elastic Detection

// EQL query for Elastic Security
sequence by source.ip, user.name with maxspan=5m
  [ network where event.action == "connection_established" and destination.port == 8080 ]
  [ http where
      http.request.method == "GET" and
      http.request.uri like~ "*file/download*path=*" and
      (
        http.request.uri like~ "*path=*%2e%2e%2f*" or
        http.request.uri like~ "*path=*../*" or
        http.request.uri like~ "*path=*%2e%2e%2f*"
      ) and
      (
        http.request.uri like~ "*etc/passwd*" or
        http.request.uri like~ "*etc/shadow*" or
        http.request.uri like~ "*application.properties*" or
        http.request.uri like~ "*id_rsa*" or
        http.request.uri like~ "*.ssh*"
      )
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri, "%/file/download%") 
  AND like(uri, "%path=%")
  AND (like(uri, "%..%2f%") OR like(uri, "%../%") OR like(uri, "%....//%") OR like(uri, "%252e%252e%252f%"))
  AND (like(uri, "%etc/passwd%") OR like(uri, "%etc/shadow%") OR like(uri, "%application.properties%") OR like(uri, "%id_rsa%") OR like(uri, "%.ssh%") OR like(uri, "%web.xml%"))
| stats count by src_ip, dest_host, uri, user, status
| sort - count

Wazuh OSSEC Rule

<group name="web,dreammaker,cve-2026-10074,">
  <rule id="202674" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\./file/download</field>
    <regex>path=(\.\./|%2e%2e%2f|\.\.%2f){2,}</regex>
    <regex>path=.*(etc/passwd|etc/shadow|application\.properties|id_rsa|\.ssh|web\.xml)</regex>
    <description>CVE-2026-10074 - DreamMaker Arbitrary File Read attempt detected</description>
    <group>web_application_attack,path_traversal,</group>
    <mitre>
      <id>T1083</id>
    </mitre>
    <options>no_full_log</options>
    <alert>
      <group>web</group>
      <severity>6</severity>
    </alert>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

Vendor upstream has released a patched version, Java Composer 2.3 or later, per the CNA (twcert). This patch has not been independently verified by third-party researchers, so validation should be performed after upgrading.

1) Immediate Mitigations (within 24-48 hours):

• Disable or restrict access to the file download endpoint (/api/file/download) via web application firewall (WAF) rules or reverse proxy ACLs. Only allow access from trusted administrative IP ranges.
• Enforce network segmentation — ensure the DreamMaker host is isolated from the broader network to limit lateral movement in case of exploitation.
• Review current logs for any existing path traversal attempts (use the detection queries in this report).
• Rotate all credentials that may be exposed in configuration files readable by the DreamMaker service account (database passwords, API keys, encryption keys).

2) Patch/Upgrade Steps:

• Contact Interinfo support or access the vendor portal to obtain Java Composer 2.3.
• Perform the upgrade in a staging environment first. Validate that all custom application components built on DreamMaker remain compatible.
• After upgrade, verify the fix by attempting the path traversal payload (../../../../etc/hostname) against the patched instance — the request should be rejected.
• Re-run the detection queries to ensure no residual exploitation indicators.

3) Long-Term Hardening:

• Apply the principle of least privilege — reduce the number of users with administrative access to DreamMaker. Monitor all privileged account activity.
• Implement file integrity monitoring on the DreamMaker host to detect unauthorized file access or modification.
• Adopt a virtual patching strategy using WAF rules that block traversal patterns, even after the official patch.
• Ensure the DreamMaker service account runs with the minimum OS privileges required, limiting the files accessible even if the vulnerability is re-triggered.
• Keep the platform up-to-date with future vendor releases and monitor the TWNCERT advisory feed for related disclosures.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-10074
2. TWNCERT (CNA) Advisory: https://www.twcert.org.tw/en/cp-139-XXXX-XXXX-1.html (search for CVE-2026-10074)
3. CWE-23 Reference: https://cwe.mitre.org/data/definitions/23.html
4. MITRE ATT&CK — T1083 File and Directory Discovery: https://attack.mitre.org/techniques/T1083/
5. EPSS Data Source (FIRST.org): https://www.first.org/epss/search?cve=CVE-2026-10074

Threat Actor Campaigns: As of the publication date, there are no known threat actor campaigns exploiting CVE-2026-10074 in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low EPSS percentile (27.4%) and absence of public PoC or Nuclei templates suggest limited adversarial interest to date; however, this status should be re-evaluated upon public disclosure of technical details or proof-of-concept code.