An authenticated path traversal vulnerability in 4ga Boards enables unauthorized local file disclosure, posing a significant risk to data confidentiality.

This is a path traversal vulnerability (CWE-22) occurring within the board import functionality. An authenticated user possessing board import privileges can manipulate the archive import process to force the server to ingest arbitrary local files, which are then accessible via the application interface.

The ability to perform unauthorized local file disclosure can lead to the exposure of sensitive configuration files, internal system data, or credentials stored on the host server. With a CVSS score of 7.6, this vulnerability represents a high risk to organizational security, as it facilitates the exfiltration of private information that could be leveraged for further attacks or compliance violations.

Immediate Action: Update the 4ga Boards installation to version 3.3.5 or later to resolve the underlying path traversal flaw.

Proactive Monitoring: Audit application access logs for unusual patterns involving file imports or requests to unexpected file paths that may indicate an attempt to access sensitive system files.

Compensating Controls: Restrict board import privileges to a strictly limited set of trusted users and implement file system permissions that prevent the application service account from accessing directories outside of its intended scope.

Public Exploit Available: No (Exploit available: false)

The severity of this flaw necessitates immediate remediation, as it provides a direct path for attackers to bypass access controls and obtain sensitive server-side data. Administrators must prioritize upgrading to version 3.3.5 to eliminate the vulnerability. Until an update is applied, organizations should audit user permissions to ensure that only essential personnel hold the privileges required to import board archives, thereby reducing the attack surface.