A critical absolute path traversal vulnerability in HAMASTAR Technology MeetingHub allows unauthenticated attackers to remotely access sensitive system files.

The application suffers from an absolute path traversal flaw (CWE-36), which enables an unauthenticated attacker to bypass security controls and retrieve arbitrary files from the host server.

Successful exploitation of this vulnerability poses a severe risk to organizational confidentiality. By accessing sensitive system files, an attacker may obtain configuration data, credentials, or other proprietary information, leading to full system compromise. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized data exfiltration.

Immediate Action: Update the MeetingHub software to version 20251210 or later as provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal sequences or attempts to access system-level files.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block incoming requests containing absolute path traversal patterns, such as sequences targeting sensitive system directories.

Public Exploit Available: Unknown

Given the high impact of arbitrary file read vulnerabilities, administrators should prioritize applying the vendor-supplied patch. Organizations that cannot immediately update the software should implement restrictive WAF rules to mitigate the risk of traversal attacks while planning for a maintenance window to install the necessary security updates.