An unauthenticated path traversal vulnerability in Apache Jena Fuseki permits attackers to read sensitive files from the host filesystem, resulting in potential information disclosure.

This vulnerability is a path traversal flaw (CWE-22) that allows an attacker to manipulate file paths to access directories outside of the intended scope. It can be exploited by unauthenticated remote users to retrieve configuration files, credentials, or other sensitive system data.

The CVSS score of 7.5 highlights a high risk to the confidentiality of the server. Successful exploitation could lead to full system enumeration or the theft of credentials stored in the application environment, facilitating further lateral movement within the network.

Immediate Action: Monitor the Apache Jena security mailing list for the release of a patched version and apply the update immediately upon availability.

Proactive Monitoring: Review server access logs for requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at the Jena Fuseki interface.

Compensating Controls: Configure the underlying web server or reverse proxy to sanitize requests and restrict access to the application, ensuring that only trusted IP addresses can reach the service.

Public Exploit Available: No

Given the potential for unauthenticated file access, this vulnerability should be treated with high priority. Organizations using Apache Jena Fuseki should restrict network access to the service as a temporary measure and prepare for an emergency update cycle once the vendor provides the necessary security patches.