A directory traversal vulnerability in EVE-NG 6.4.0-13-PRO allows authenticated users to access unauthorized files, posing a significant risk to system confidentiality.

The /api/export interface fails to perform adequate input validation on file path parameters, enabling an authenticated attacker to traverse the directory structure and read files outside of the intended scope.

The ability to perform directory traversal can lead to the unauthorized disclosure of sensitive system files, configuration data, or credentials. With a CVSS score of 7.6, this vulnerability represents a high risk to the confidentiality and integrity of the lab environment, potentially facilitating further lateral movement or privilege escalation within the network.

Immediate Action: Contact the vendor immediately to obtain the latest security patch for EVE-NG 6.4.0-13-PRO, as a specific fix version is currently not publicly disclosed.

Proactive Monitoring: Review web access logs for the /api/export endpoint, specifically monitoring for requests containing directory traversal sequences such as double dots or encoded path separators.

Compensating Controls: Implement strict access control lists and, where possible, use a Web Application Firewall to block requests containing suspicious path traversal patterns directed at the API.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the research write-up referenced in the CVE record.

Given the existence of a public proof-of-concept and the high CVSS severity, organizations utilizing EVE-NG 6.4.0-13-PRO should prioritize restricting access to the management interface. Ensure that only authorized personnel have access to the platform and engage with the vendor immediately to confirm the availability of a remediation update to close this traversal vector.