A critical directory traversal vulnerability in Doom Launcher 3.8.1.0 allows unauthenticated attackers to read sensitive files on the host system.

The application fails to properly sanitize file paths during the extraction process, enabling an unauthenticated attacker to bypass directory restrictions and access arbitrary files on the filesystem.

This vulnerability carries a CVSS score of 7.5, indicating a high severity risk that could lead to significant data exposure. Successful exploitation permits an attacker to read sensitive configuration files, credentials, or system data, potentially leading to a full compromise of the local environment where the software is installed.

Immediate Action: Users should restrict the use of Doom Launcher 3.8.1.0 until an official security patch is released by the vendor to address the file path validation issue.

Proactive Monitoring: Security teams should monitor file system access logs for unusual read requests or attempts to access files outside of the expected game data directories.

Compensating Controls: Deploy endpoint security solutions to detect and block unauthorized file system traversal patterns originating from the Doom Launcher process.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked technical advisory from Jeroscope.

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability poses a significant risk to system integrity. Administrators should prioritize isolating instances of the affected software and monitor for any signs of exploitation until a formal patch is provided by the vendor.