PatchSiren cyber security CVE debrief
CVE-2026-10073 Interinfo CVE debrief
DreamMaker, a software product developed by Interinfo, contains an Arbitrary File Read vulnerability that enables unauthenticated local attackers to exploit Relative Path Traversal (CWE-23) and download arbitrary system files. The vulnerability carries a HIGH severity CVSS score of 8.7. The CVE record was published on May 29, 2026, with a subsequent modification later the same day. The vulnerability is currently in 'Deferred' status per NVD records. No known exploitation in ransomware campaigns has been documented, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
- Vendor
- Interinfo
- Product
- DreamMaker
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-29
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-29
- Advisory updated
- 2026-05-29
Who should care
Organizations running DreamMaker software, particularly those with externally accessible deployments. Security teams responsible for application security and file access controls. System administrators managing Interinfo software installations. Incident response teams monitoring for path traversal exploitation patterns.
Technical summary
The vulnerability stems from insufficient input validation in DreamMaker's file handling mechanisms, allowing attackers to manipulate file paths using relative path traversal sequences (e.g., '../') to access files outside intended directories. The attack requires local network access but no authentication, with low attack complexity. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) indicates network accessibility, high confidentiality impact, but no integrity or availability impact. The 'Deferred' NVD status suggests the entry may await additional analysis or vendor coordination.
Defensive priority
HIGH
Recommended defensive actions
- Review TWCERT/CC advisories for affected product versions and patch availability
- Implement network segmentation to limit exposure of DreamMaker deployments
- Apply principle of least privilege to DreamMaker service accounts
- Monitor for anomalous file access patterns indicative of path traversal exploitation
- Verify input validation and path sanitization controls in DreamMaker file handling components
- Await vendor security advisory from Interinfo for official remediation guidance
Evidence notes
Vendor identification relies on reference domain candidate evidence with low confidence; the vendor field is marked for review. The vulnerability classification as CWE-23 (Relative Path Traversal) is sourced from TWCERT/CC. CVSS vector indicates network attack vector with low attack complexity, no privileges required, and high confidentiality impact.
Official resources
The vulnerability was disclosed through Taiwan's Computer Emergency Response Team/Coordination Center (TWCERT/CC), with advisory references published in both English and Traditional Chinese. The vendor attribution to Interinfo for the Dream