A critical path traversal vulnerability in the Mitchell Bennis Simple File List plugin exposes server files to unauthenticated remote attackers.

The plugin fails to properly sanitize user input, allowing for path traversal (CWE-22) via the simple-file-list component. This flaw is remotely exploitable by unauthenticated users, granting them unauthorized access to sensitive files on the underlying filesystem.

The ability for an unauthenticated attacker to read arbitrary files poses a severe risk to organizational confidentiality. An attacker could potentially retrieve sensitive configuration files, database credentials, or system information, leading to full system compromise or significant data breaches. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized data exfiltration.

Immediate Action: Review the official vendor advisory for available security patches and update the Simple File List plugin to the latest version immediately.

Proactive Monitoring: Review web server logs for suspicious requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the plugin endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized access attempts to the plugin directory.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for complete exposure of sensitive server data, organizations using the Simple File List plugin must prioritize this update. If a patch is not currently available, administrators should consider disabling the plugin until a secure version is released to mitigate the risk of unauthorized file access.