An unauthenticated path traversal vulnerability exists in all versions of the cast-localvideo application, posing a critical risk of unauthorized sensitive file access.

The application improperly handles user-supplied input in the app.js handler, where the req.body.dir parameter is passed directly to the res.sendFile function. This lack of sanitization allows an unauthenticated remote attacker to use directory traversal sequences to access files outside the intended web directory.

Successful exploitation allows unauthorized access to arbitrary files on the server, potentially exposing configuration files, environment variables, or other sensitive system data. With a CVSS score of 7.5, this vulnerability represents a significant risk to confidentiality, as attackers can bypass standard access controls to exfiltrate information from the host.

Immediate Action: Since all versions are affected and no official patch is listed, users should restrict network access to the application or deactivate the service until a secure version is released.

Proactive Monitoring: Review web server access logs for requests containing directory traversal patterns such as "../" or absolute file paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block requests containing path traversal sequences directed at the vulnerable endpoint.

Public Exploit Available: No (unknown)

Due to the lack of a current patch and the ease of exploitation, immediate mitigation is required. Organizations currently running this software should treat it as insecure and restrict external access until the vendor provides a remediation or the application is replaced.