An unauthenticated directory traversal vulnerability in the Omnispace Agora Project poses a significant risk to sensitive file confidentiality.

This is a directory traversal vulnerability (CWE-22) triggered by an unauthenticated attacker. The flaw resides within the misc controller and the ExternalGetFile action, allowing unauthorized read access to system files that possess a file extension.

The ability for an unauthenticated user to read arbitrary files from the server filesystem presents a severe risk of information disclosure. With a CVSS score of 7.5, this high-severity vulnerability could lead to the exposure of configuration files, credentials, or sensitive application data, potentially facilitating further system compromise or data breaches.

Immediate Action: Update the Agora Project software to version 25.10 or later immediately to resolve the directory traversal flaw.

Proactive Monitoring: Review web server and application access logs for suspicious requests targeting the misc controller or the ExternalGetFile action, particularly those containing path traversal sequences like dot-dot-slash patterns.

Compensating Controls: Implement Web Application Firewall (WAF) rules to detect and block requests containing directory traversal sequences directed at the identified vulnerable endpoint until the patch can be applied.

Public Exploit Available: Unknown.

Given the high CVSS score and the existence of a proof-of-concept, organizations must prioritize upgrading the Agora Project to version 25.10. Failure to patch allows unauthorized actors to bypass access controls and access potentially sensitive files on the host system, which could serve as a precursor to a more comprehensive system takeover.