CVE-2017-10974: Yaws web server path traversal allows unauthenticated file disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote file disclosure with public exploit code and very high EPSS, though not in KEV and limited to confidentiality impact.

What it is

Yaws 1.91 fails to properly block HTTP directory traversal when a request path begins with the /%5C sequence, letting an attacker read files outside the web root. The flaw is a path traversal (CWE-22) reachable over the network without credentials, so any exposed Yaws 1.91 instance is at risk of leaking sensitive files.

Impact

An attacker gains read access to arbitrary files on the server filesystem, which can expose configuration files, credentials, source code or other sensitive data. There is no integrity or availability impact; the loss is confidentiality only.

Attack surface

Reached remotely over HTTP against port 8080 using a crafted path beginning with /%5C../. No authentication and no user interaction are required, as reflected in the CVSS vector AV:N/PR:N/UI:N.

Exploitation

Public exploit code exists (Exploit-DB 42303 and the vendor advisory are tagged Exploit), and EPSS is very high at 0.81 (99.6th percentile), though the CVE is not listed in CISA KEV. No ransomware association is documented.

What to do

• Upgrade Yaws to a version later than 1.91 that fixes the traversal handling; if no fixed release is available, restrict or replace the deployment.
• Do not expose the Yaws listener on port 8080 to untrusted networks; place it behind a reverse proxy or firewall that normalizes and rejects encoded traversal sequences.
• Normalize and validate request paths, rejecting any path containing encoded backslashes or traversal sequences before they reach the file handler.
• Run the Yaws process with least privilege and confine it to a directory that contains no sensitive files.
• Monitor and alert on requests containing /%5C or ../ patterns in the access log.

Detection

• Search web access logs for request paths containing /%5C, %5C../, or ../ sequences targeting port 8080.
• Alert on HTTP requests whose decoded path escapes the configured document root.
• Review outbound or file-read behavior of the Yaws process for access to files outside the web root.
• Correlate repeated traversal attempts from a single source IP as likely scanning or exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.