A path traversal vulnerability in Microsoft APM permits unauthorized file access, posing a significant risk to system integrity and confidentiality.

This vulnerability (CWE-22/CWE-73) involves improper limitation of pathnames to a restricted directory, which can be exploited by an attacker to perform file operations in unintended locations.

With a CVSS score of 7.1, this vulnerability presents a high risk for unauthorized access to sensitive files or configuration data. Exploitation could result in the total compromise of the application's environment, potentially allowing attackers to read or overwrite critical system files.

Immediate Action: Update apm-cli to version 0.8.12 or later to resolve the path traversal vulnerability.

Proactive Monitoring: Monitor filesystem access logs for unusual path patterns or attempts to access directories outside of the application's defined scope.

Compensating Controls: Ensure the application process runs with the least privilege necessary, restricting the service account's ability to access sensitive system files outside of its working directory.

Public Exploit Available: Unknown.

Organizations should immediately update the APM CLI tool to the fixed version. Given the existence of a proof-of-concept and the potential for system-wide impact, prompt remediation is required to prevent unauthorized file access.