A path traversal vulnerability in Openatlas before version 8.12.0 allows authenticated attackers to potentially exfiltrate sensitive configuration files, posing a high risk to system integrity.

The application is susceptible to a path traversal flaw located in the size query parameter within the /views/file.py script. This vulnerability allows an authenticated attacker to manipulate input to access files outside of the intended directory structure.

The ability to perform path traversal can lead to the unauthorized disclosure of sensitive configuration files or system data. Given the CVSS score of 8.1, this vulnerability represents a high risk as it facilitates potential information disclosure that could be leveraged for further system compromise or credential theft.

Immediate Action: Update Openatlas to version 8.12.0 or later to ensure the path traversal vulnerability is resolved.

Proactive Monitoring: Review web server and application access logs for suspicious requests containing directory traversal patterns, such as sequences of dots and slashes, directed at the size parameter.

Compensating Controls: Implement strict input validation or use a Web Application Firewall (WAF) to filter and block requests containing directory traversal sequences targeting the affected endpoint.

Public Exploit Available: No (the referenced security write-up provides technical detail, but no functional exploit code).

This vulnerability presents a significant risk to data confidentiality due to the potential for unauthorized file access. Administrators should prioritize upgrading to Openatlas version 8.12.0 immediately to eliminate the underlying flaw. If an immediate update is not feasible, restrict access to the affected service and implement rigorous input filtering at the network perimeter.