An unauthenticated path traversal vulnerability in xemle home-gallery allows attackers to access sensitive system files, posing a high security risk.

This vulnerability is a Path Traversal flaw (CWE-22) occurring when the application fails to validate the directory path of requested files. An unauthenticated attacker can exploit this to escape the intended media source directory and retrieve arbitrary files from the underlying host system.

The ability for an unauthenticated user to retrieve arbitrary system files poses a severe risk of information disclosure. Successful exploitation could lead to the exposure of credentials, configuration files, or other sensitive data, resulting in full system compromise or unauthorized access to the host environment. With a CVSS score of 8.6, this vulnerability represents a significant threat to the confidentiality and integrity of the hosting infrastructure.

Immediate Action: Update the home-gallery installation to version 1.21.0 or later immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review web server and application access logs for patterns involving directory traversal sequences, such as multiple occurrences of dot-dot-slash (../) sequences in download requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block incoming HTTP requests containing path traversal characters or suspicious file path patterns.

Public Exploit Available: No

Given the ease of exploitation and the potential for unauthorized access to sensitive system data, organizations utilizing home-gallery must prioritize upgrading to version 1.21.0. Failure to patch this vulnerability leaves the underlying server exposed to trivial information theft. Please ensure that all instances of the software are identified and updated as part of your immediate security maintenance cycle.