A critical absolute path traversal vulnerability in Navtor NavBox allows unauthenticated remote attackers to access sensitive system files, posing a significant risk to data confidentiality.

This vulnerability occurs due to improper sanitization of user-supplied path input within the Navtor NavBox HTTP service. The flaw allows an unauthenticated remote attacker to submit requests containing absolute filesystem paths to read arbitrary files from the server.

Successful exploitation of this vulnerability permits the unauthorized disclosure of sensitive configuration files and system information. Given the CVSS score of 7.5, this high-severity flaw could lead to further system compromise or credential theft, potentially resulting in unauthorized access to broader infrastructure.

Immediate Action: Update Navtor NavBox to version 4.14.1.2 or later to apply the necessary security patches and input validation controls.

Proactive Monitoring: Review web access logs for suspicious HTTP requests containing directory traversal sequences or absolute file paths, such as those targeting system configuration directories.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block incoming HTTP requests that contain directory traversal patterns or unauthorized path references until the patch is applied.

Public Exploit Available: Unknown.

The vulnerability presents a significant risk to the confidentiality of Navtor NavBox deployments. Administrators should prioritize updating to version 4.14.1.2 immediately to remediate the underlying flaw. Due to the ease of exploitation, failure to patch leaves the system exposed to unauthorized information disclosure.