A directory traversal vulnerability in OpenCTI 3.3.1 allows unauthenticated attackers to read sensitive system files, posing a significant risk to confidentiality.

The application fails to properly sanitize user input provided to the static/css endpoint, enabling path traversal sequences such as ../ to escape the intended directory. This flaw allows an unauthenticated attacker to retrieve arbitrary files from the underlying server filesystem.

Successful exploitation of this vulnerability permits unauthorized access to sensitive configuration files, system credentials, or other critical data stored on the server. Given the CVSS score of 7.5, this is considered a high-severity risk that could lead to full system compromise or facilitate further attacks. The ability for an unauthenticated user to perform these actions makes this an urgent concern for organizations hosting OpenCTI.

Immediate Action: Upgrade to a version of OpenCTI that addresses this directory traversal vulnerability, as version 3.3.1 is confirmed to be vulnerable.

Proactive Monitoring: Review web server and application access logs for anomalous GET requests containing repeated path traversal patterns like ../ or attempts to access common system files such as /etc/passwd.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block requests containing directory traversal sequences directed at the static/css endpoint.

Public Exploit Available: Yes, a public exploit is available via the Exploit Database (EDB-ID 48595).

Organizations utilizing OpenCTI 3.3.1 must prioritize patching to a secure version immediately to prevent unauthorized data exfiltration. Given the availability of a public exploit, the window for remediation is narrow, and administrators should assume that the vulnerability is well-understood by threat actors.