PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10075 Interinfo CVE debrief

A path traversal vulnerability in DreamMaker, developed by Interinfo, allows unauthenticated remote attackers to read file names under arbitrary paths via absolute path traversal. The vulnerability is classified as CWE-36 (Absolute Path Traversal) and carries a CVSS 4.0 score of 6.9 (Medium severity). The issue was disclosed on May 29, 2026, with advisory sources from Taiwan's TW-CERT. No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Vendor
Interinfo
Product
DreamMaker
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-21
Advisory published
2026-05-29
Advisory updated
2026-07-21

Who should care

Organizations running DreamMaker software should prioritize assessment and patching. Security teams should monitor for exploitation attempts targeting path traversal vulnerabilities. Developers working with file system operations in web applications should review input validation practices. Incident response teams should include this CVE in threat intelligence monitoring given its network-exploitable, unauthenticated nature.

Technical summary

The vulnerability exists in DreamMaker, a software product developed by Interinfo. An unauthenticated remote attacker can exploit an absolute path traversal weakness (CWE-36) to enumerate file names at arbitrary file system paths. The attack requires no privileges or user interaction and can be conducted over the network with low attack complexity. The confidentiality impact is rated low per CVSS 4.0, with no integrity or availability impact. The CVSS vector string is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N.

Defensive priority

medium

Recommended defensive actions

  • Review and apply security patches from Interinfo when available
  • Implement input validation and path sanitization for file system operations
  • Restrict file system access permissions to prevent unauthorized directory traversal
  • Monitor for anomalous file access patterns in DreamMaker deployments
  • Verify vendor attribution and product version details through official Interinfo channels

Evidence notes

The vulnerability description and CVSS vector are sourced from the official NVD record. The CWE-36 classification and advisory links are attributed to TW-CERT as the primary source. Vendor identification remains under review due to low-confidence domain attribution in source metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10075 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10075

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10075 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10075

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.