A path traversal vulnerability in Sanster IOPaint version 1.5.3 allows unauthenticated remote attackers to access arbitrary files on the host system.

This is a path traversal vulnerability (CWE-22) located within the _get_file function of the file manager component. An unauthenticated remote attacker can supply a crafted filename argument to read files outside of the intended directory structure.

The ability for an unauthenticated user to perform arbitrary file reads poses a significant risk to the confidentiality of the host system. Depending on the environment, this could lead to the exposure of sensitive configuration files, environment variables, or stored credentials. With a CVSS score of 7.3, this high-severity flaw represents a notable risk to system integrity and data security.

Immediate Action: Since no official patch is currently available, users should restrict network access to the IOPaint instance and monitor for suspicious file-access patterns. If possible, isolate the application within a container with strictly limited file system permissions.

Proactive Monitoring: Review application access logs for attempts to use directory traversal sequences, such as dot-dot-slash patterns, directed at the file manager endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule designed to detect and block path traversal attempts containing directory traversal sequences in URL parameters or request bodies.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked technical research write-up on GitHub.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an immediate risk. Administrators must prioritize isolating the affected service from public access until a security update is released and verified. Continuous monitoring of server logs for unauthorized path traversal attempts is essential to detect potential exploitation efforts.