CVE-2026-10075

Executive Summary

CVE-2026-10075 is a high-severity Absolute Path Traversal vulnerability (CWE-36, CVSS 6.9) affecting DreamMaker, a low-code development platform by Interinfo. An unauthenticated remote attacker can exploit this flaw to enumerate files and directories across arbitrary paths on the underlying server filesystem by manipulating application parameters to traverse outside the web root. Given the unauthenticated nature of the flaw and DreamMaker's typical deployment in enterprise environments for rapid application development, the vulnerability exposes business-critical information, source code, configuration files, and credentials to potential theft or further exploitation, effectively acting as a reconnaissance and data-exfiltration vector against affected deployments.

Technical Analysis

The vulnerability resides in the DreamMaker application developed by Interinfo, a Taiwanese software vendor. The flaw is classified as an Absolute Path Traversal vulnerability, meaning the application accepts an attacker-controlled input that is directly used to access filesystem paths without proper sanitization or validation. Unlike relative path traversal (which uses ../ sequences to move up directories), absolute path traversal exploits the ability of the application to read files using a fully qualified path such as C:\Users\... or /etc/passwd.

The root cause is a classic lack of input validation: DreamMaker's web interface exposes parameters—likely related to file download, file preview, or asset rendering—that are passed directly to filesystem APIs. When an attacker supplies an absolute path (e.g., C:\Windows\win.ini, /etc/shadow, file:///etc/passwd) as the parameter value, the application follows the path and serves the file content back to the requester without authentication or authorization checks.

Attack Surface: The vulnerability is likely reachable from multiple endpoints. Common attack surfaces in low-code platforms include file upload/download handlers, template rendering engines, and resource loading endpoints. Since the CNA title explicitly mentions "Path Traversal" and the NVD description notes "unauthenticated remote attackers," the vulnerable code path is exposed over HTTP/HTTPS without requiring any prior login or session.

Code-Level Explanation (hypothesized): The Java-based DreamMaker (vendor fix refers to "Java Composer 2.3") likely performs a filesystem operation similar to:

String filePath = request.getParameter("file");
// Missing validation for absolute paths
File file = new File(filePath);
return serveFile(file);

The application fails to verify that the resolved path is contained within the intended directory (e.g., the user's workspace or an uploads directory). An attacker can supply ../../../../etc/passwd or an absolute path like C:\Windows\System32\drivers\etc\hosts to bypass the intended sandbox.

Affected Versions: The exact vulnerable version range is not disclosed in the NVD entry, but the vendor fix states that versions prior to Java Composer 2.3 are affected. Enterprises running DreamMaker Java Composer versions earlier than 2.3 should consider themselves vulnerable.

Exploitation Scenarios

The following step-by-step attack chain describes how an unauthenticated remote attacker would exploit CVE-2026-10075:

Step 1: Reconnaissance and Target Identification An attacker begins by scanning for accessible DreamMaker instances. They can use search engines like Shodan or Fofa with queries targeting the application's unique HTTP signatures. DreamMaker admin consoles typically expose identifiable login pages and web interfaces. Acceptable dorks include:

• http.title:"DreamMaker"
• http.component:"DreamMaker"
• http.title:"Interinfo"

The attacker also fingerprints the server OS (Linux vs. Windows) via response headers (Server:, X-Powered-By:) or by attempting path probe requests.

Step 2: Parameter Fuzzing for the Vulnerable Endpoint The attacker enumerates likely vulnerable parameters by sending crafted HTTP requests to common endpoints. They probe for parameters named file, filename, path, download, template, resource, or view across GET and POST requests. A typical request pattern:

GET /download?file=test.jsp HTTP/1.1
Host: target.com

They iterate with absolute path payloads to detect reflective behavior.

Step 3: Triggering the Absolute Path Traversal — Payload Delivery Once a parameter is identified, the attacker sends the absolute path traversal payload. For a Windows-hosted instance:

GET /download?file=C:\Windows\win.ini HTTP/1.1
Host: target.com

For a Linux-hosted instance:

GET /download?file=/etc/passwd HTTP/1.1
Host: target.com

To evade basic filters that block forward slashes or backslashes, the attacker uses URL encoding or double encoding:

• file=%2fetc%2fpasswd (URL-encoded forward slash)
• file=..%2f..%2f..%2fetc%2fpasswd (mixed encoding)
• file=/etc/passwd%00 (null byte, if the backend uses C-style strings)

Step 4: File Enumeration and Data Exfiltration Successful exploitation returns the contents of the targeted file in the HTTP response body. The attacker can then:

• Read C:\Windows\System32\config\SAM (Windows) or /etc/shadow (Linux) — though hashes may be extracted.
• Read application configuration files: application.properties, web.xml, db.properties, .env — yielding database credentials and API keys.
• Read source code files (.java, .jsp, .py) from the web root to map the entire application logic, enabling further attacks.
• Enumerate directory listings to locate sensitive backup archives (.zip, .bak) and private key material.
• Chain the read with server-side request forgery (SSRF) if the file read can be redirected to internal network resources.

Step 5: Post-Exploitation With extracted credentials, the attacker may pivot: authenticate to the DreamMaker admin console, connect to the backend database directly, or use harvested secrets to compromise adjacent systems. The attacker could also use the file enumeration to locate log files containing session tokens, enabling account hijacking.

Parenthetical note: No public exploit code exists for this CVE as of the report date; however, the vulnerability class is trivially exploitable with plain HTTP requests, requiring no special tools beyond curl or a web browser.

Impact Assessment

Given the CVSS score of 6.9 (Medium severity per the CVSS 3.x scale), the vulnerability is rated one step below High. Despite the moderate score, the business impact is significant due to the unauthenticated nature and scope of file disclosure.

• Confidentiality Impact (High): The ability to read any file name on the server with a known or guessable path results in complete compromise of sensitive data on the host. Application source code, credentials, and user PII are at risk.
• Integrity Impact (None): The vulnerability is read-only; the attacker cannot modify or overwrite files.
• Availability Impact (None): No denial-of-service conditions are directly achievable via this flaw.
• Attack Complexity (Low to Medium): The absolute path traversal requires the attacker to know or guess server file paths. Internal server paths are often predictable in default installations, lowering complexity.
• Blast Radius: The affected systems are DreamMaker instances running Java Composer < 2.3. Since DreamMaker is a rapid-application-development platform, it often runs alongside critical business databases and internal tooling, meaning a breach of the web server could expose data used by downstream enterprise processes. The read of configuration files (e.g., DB connection strings) typically grants lateral movement capability.
• Exploitation Likelihood: EPSS score of 0.00387 (31.4th percentile) indicates low active exploitation in the wild as of this report. However, the low complexity makes it a candidate for future mass-scanning if the vulnerable endpoints become widely known. The CISA KEV database does not list this CVE at the time of writing, confirming no confirmed in-the-wild exploitation.

Detection Guidance

Sigma Rule

The following Sigma rule detects GET/POST requests containing absolute path traversal patterns targeting common web application file parameters.

title: CVE-2026-10075 - Absolute Path Traversal in DreamMaker
id: 5f4c2a5e-8d1e-4b0a-9c3f-1d2a5e8c4b3f
status: experimental
description: Detects absolute path traversal attempts in HTTP requests to DreamMaker file download/view parameters
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-10075
    - https://www.twcert.org.tw
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection_base:
        cs-method:
            - 'GET'
            - 'POST'
    selection_path_traversal_absolute_windows:
        cs-uri-query|contains:
            - 'file=C:'
            - 'filename=C:'
            - 'path=C:'
            - 'download=C:'
    selection_path_traversal_absolute_linux:
        cs-uri-query|contains|all:
            - 'file='
        cs-uri-query|startswith:
            - '%2f'
            - '////'
    selection_url_encoded:
        cs-uri-query|contains:
            - '%2f%2f'
            - '..%2f'
            - '%252e%252e'
    condition: selection_base and (selection_path_traversal_absolute_windows or selection_path_traversal_absolute_linux or selection_url_encoded)
level: high
tags:
    - attack.t1190
    - cve.2026.10075
    - cwe.36

YARA Rule

The following YARA rule scans web server access logs or captured HTTP traffic for CVE-2026-10075 exploit payloads.

rule CVE_2026_10075_Absolute_Path_Traversal_DreamMaker
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects absolute path traversal payloads targeting DreamMaker"
        cve = "CVE-2026-10075"
        date = "2026-01-01"
        severity = "high"
    strings:
        // Windows absolute paths (C:, D:, etc.)
        $win_path1 = /(file|filename|path|download)=[A-Z]:[\\\\\/]/ nocase
        $win_path2 = /(file|filename|path|download)=%[A-Z0-9]{2}:[\\\\\/]/ nocase
        // Linux absolute paths: /etc, /var, /proc, /home
        $linux_path1 = /(file|filename|path|download)=[\/]{1,2}(etc|var|proc|home|root|usr|opt|boot)/ nocase
        // URL-encoded absolute paths
        $enc_path1 = /(file|filename|path|download)=%2f(etc|var|proc|home|root)/ nocase
        // Double-encoded traversal
        $enc_path2 = /%252e%252e%252f/
        $enc_path3 = /%2e%2e%2f/
    condition:
        any of ($win_path*) or any of ($linux_path*) or $enc_path1 or $enc_path2 or $enc_path3
}

Suricata IDS Rule

This Suricata rule triggers on HTTP responses and requests that match the traversing pattern.

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-10075 - DreamMaker Absolute Path Traversal Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    uricontent:"file="; nocase;
    uricontent:"C:"; nocase;
    pcre:"/file=(C:|\/etc\/|\/var\/|%2fetc%2f|%2fvar%2f)/";
    classtype:attempted-recon;
    sid:2026100751;
    rev:1;
    metadata:created_at 2026_01_01, cve CVE-2026-10075;
)

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-10075 - DreamMaker File Download Path Traversal";
    flow:to_server,established;
    content:"download="; nocase;
    http_uri;
    pcre:"/(file|download|path|filename)=[\/]{1,2}(etc|var|proc|C:)/i";
    classtype:attempted-recon;
    sid:2026100752;
    rev:1;
    metadata:created_at 2026_01_01, cve CVE-2026-10075;
)

Elastic Detection

This Elastic EQL query identifies web access logs where the URI query contains absolute path payloads.

sequence by source.ip with maxspan=5m
  [ any where
      /* web server access logs */
      event.category : "web" and network.protocol : "http" and
      url.path : ("/download*", "/view*", "/file*", "/resource*") and
      url.query : (
        "*file=C:*", "*file=/etc/*", "*file=/var/*", "*file=/proc/*",
        "*filename=C:*", "*path=C:*", "*path=/etc/*",
        "*file=%2fetc%2f*", "*file=%2fvar%2f*"
      )
  ]

Splunk SPL Query

index=web* sourcetype=access_combined OR sourcetype=iis
| where match(uri_query, "(file|filename|path|download)=(C:|/etc/|/var/|/proc/|%2fetc%2f|%2fvar%2f)") 
   OR match(uri_query, "(%2e%2e%2f|%252e%252e%252f)")
| stats count by src_ip, uri_path, uri_query, status
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,recon,">
    <rule id="100750" level="12">
        <if_sid>31100</if_sid>
        <regex> (file|filename|path|download)=(C:|/etc/|/var/|/proc/|%2fetc%2f|%2fvar%2f) </regex>
        <description>CVE-2026-10075: DreamMaker absolute path traversal attempt detected.</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>attack_pentest,pci_dss_6.5.1,gdpr_32,</group>
    </rule>
    <rule id="100751" level="10">
        <if_sid>100750</if_sid>
        <regex> (GET|POST) </regex>
        <description>CVE-2026-10075: Traversal using absolute path in query string.</description>
        <group>attack_recon,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The vendor (via CNA) indicates a fix exists in Java Composer 2.3 or later, but this has not been independently verified by third-party researchers or the NVD. Deploy stringent testing before a full upgrade.

1) Immediate Mitigations (while awaiting patch verification):

• Network-level ACLs: Restrict access to the DreamMaker web application to trusted IP ranges or a VPN. Do not expose the admin interface to the public internet.
• Web Application Firewall (WAF): Deploy or update WAF rules that block query parameters matching the patterns file=, filename=, path=, download= containing absolute paths (C:, /etc/, /var/, /proc/, etc.), or containing URL-encoded traversal sequences.
• Reverse Proxy Filtering: If a reverse proxy (e.g., Nginx, HAProxy) fronts the application, add a rule to reject URIs containing %2f for absolute path parameters, or block requests with multiple consecutive forward slashes in relevant parameters.
• Disable Unused Modules: If file download/preview features are not used, disable them in the application configuration.

2) Patch/Upgrade Steps:

• Upgrade Java Composer to version 2.3 or later immediately. This is the vendor-recommended fix.
• Before applying, verify the patch integrity by checking the vendor's official site or via their CNA advisory.
• Since the Patch Confidence is 2/4 (claimed but not fully verified), perform the upgrade in a staging environment first. Test the application’s core functionality and, crucially, verify that absolute path traversal is no longer possible using the original PoC payloads.
• After upgrade, re-check dreammaker version in the admin console or via application logs to confirm the build.

3) Long-Term Hardening:

• Input Validation: Mandate that the development team performs strict whitelist-based validation for all file access parameters. Restrict input to a whitelist of allowed filenames or a canonicalization function that rejects absolute paths and traversal sequences.
• Filesystem Permissions: Run the DreamMaker service under a low-privileged account with read access only to the minimum directories required. Restrict access to /etc, /var, and C:\Windows\System32 via OS-level permissions.
• Security Audits: Conduct regular code audits of the DreamMaker application, focusing on file I/O operations. Implement automated SAST and DAST scans in the CI/CD pipeline.
• Monitor CVE notifications from TWNCERT (TWCERT/CC is the Taiwanese national CERT) and subscribe to vendor advisories for future related fixes in other DreamMaker components.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-10075 — National Vulnerability Database record for CVE-2026-10075.
2. TWCERT/CC Advisory: https://www.twcert.org.tw/en/cp139-xxxx.html — Taiwan Computer Emergency Response Team / Coordination Center (TWCERT/CC) advisory detailing the DreamMaker vulnerability and patch recommendation (Java Composer 2.3).
3. CWE-36 - Absolute Path Traversal: https://cwe.mitre.org/data/definitions/36.html — MITRE CWE definition describing the vulnerability class.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Confirms this CVE is not currently listed in the KEV catalog, indicating no confirmed exploitation in the wild.
5. ATT&CK T1190 - Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — MITRE ATT&CK technique applicable to the exploitation of this external-facing web vulnerability.

Threat Actor Campaigns / Exploit-in-the-Wild: As of this report date, there are no known threat actor campaigns specifically targeting CVE-2026-10075, and no evidence of exploitation in the wild has been publicly recorded. The low EPSS percentile (31.4%) reflects this lack of active exploitation. However, given the trivial nature of the attack, enterprises are urged to apply the vendor patch proactively rather than rely on the absence of known attacks.