A directory traversal vulnerability in VvvebJs 1.7.2 allows unauthenticated attackers to read unauthorized files, posing a significant risk to information confidentiality.

The application is vulnerable to directory traversal via the scan.php endpoint, which permits unauthenticated remote attackers to bypass path restrictions and access arbitrary files on the underlying filesystem.

The ability for an unauthenticated attacker to read arbitrary files can lead to the exposure of sensitive configuration files, environment variables, or source code. With a CVSS score of 7.5, this high-severity vulnerability could facilitate further system compromise or data exfiltration, directly impacting the confidentiality and integrity of the affected environment.

Immediate Action: Restrict access to the scan.php file at the web server level and monitor for vendor-provided security updates to address the underlying code flaw.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal patterns such as dot-dot-slash sequences directed at the scan.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing directory traversal characters or unauthorized attempts to access sensitive system files.

Public Exploit Available: Yes: A published proof-of-concept exists via the technical write-up referenced in the CVE record (GitHub Gist).

Given the high CVSS score and the public availability of a proof-of-concept, this vulnerability should be prioritized for remediation. Organizations using VvvebJs 1.7.2 must immediately implement access controls to prevent exploitation while awaiting an official vendor patch.