A critical path traversal vulnerability in UnPoller 2.33.0 allows unauthenticated attackers to read sensitive files and exfiltrate data from the host system.

The application fails to properly sanitize user input in the password field, enabling a path traversal attack. This flaw allows an unauthenticated, remote attacker to read arbitrary files on the underlying filesystem.

The ability to read arbitrary files poses a significant risk to organizational confidentiality, as attackers may extract sensitive configuration files, credentials, or system data. With a CVSS score of 7.5, this high-severity vulnerability could lead to total system compromise or lateral movement within the network.

Immediate Action: Monitor the vendor repository for the release of a security patch and apply it immediately upon availability. If no patch is available, restrict access to the UnPoller interface to trusted internal networks only.

Proactive Monitoring: Review web server and application logs for suspicious request patterns, specifically looking for directory traversal sequences like dot-dot-slash in password or authentication fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts containing directory traversal sequences.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub (SyntaxSaiyan/CVE-2026-36851).

Given the exposure of sensitive files and the availability of a public proof-of-concept, this vulnerability represents a substantial risk. Administrators must prioritize limiting access to the affected service while awaiting a vendor-supplied patch to ensure the security of the host environment.