A critical path traversal vulnerability in Yordam Katalog allows unauthenticated remote attackers to read unauthorized files, posing a significant risk to data confidentiality.

This is a path traversal flaw (CWE-27) occurring within the application directory handling logic. The vulnerability is exploitable by unauthenticated remote attackers who can craft malicious requests to access files outside of the intended directory.

The ability for an unauthenticated user to perform path traversal represents a severe security risk, as it may lead to the unauthorized disclosure of sensitive configuration files, credentials, or system data. With a CVSS score of 8.6, this vulnerability is categorized as high severity due to its potential for full unauthorized access to system files, which could lead to complete system compromise or further lateral movement within the network.

Immediate Action: Upgrade Yordam Katalog to version 21.7 or later as soon as the vendor provides the update. In the absence of a direct patch, restrict network access to the application to only trusted IP addresses.

Proactive Monitoring: Review web server access logs for anomalous directory traversal patterns, such as sequences containing multiple dots and slashes, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts, specifically targeting patterns involving dot-dot-slash sequences.

Public Exploit Available: Unknown

Given the high CVSS score and the unauthenticated nature of the attack vector, organizations running Yordam Katalog must prioritize this vulnerability. Ensure that monitoring is active to detect any potential reconnaissance or unauthorized access attempts while awaiting the official patch release from the vendor.