A path traversal vulnerability in PostCSS, rated high severity, allows unauthenticated attackers to access sensitive files on the host system.

The software contains a path traversal flaw (CWE-22) within its API that processes CSS files, permitting an unauthenticated attacker to bypass directory restrictions and read unauthorized files.

Successful exploitation allows an attacker to read arbitrary files from the server, potentially exposing configuration files, source code, or sensitive environment variables. With a CVSS score of 7.5, this high-severity vulnerability poses a significant risk to data confidentiality, as it enables unauthorized information disclosure without requiring user interaction or authentication.

Immediate Action: Update the PostCSS package to version 8.5.18 or later to incorporate the vendor-supplied security fix.

Proactive Monitoring: Review web server and application logs for unusual file access patterns, specifically requests containing directory traversal sequences like dot-dot-slash.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common path traversal payloads and monitor outgoing traffic for suspicious data exfiltration.

Public Exploit Available: No (no weaponized exploit or public PoC confirmed in available data).

Given the potential for unauthorized file access and the existence of a proof-of-concept, organizations using PostCSS must prioritize upgrading to version 8.5.18. Immediate remediation is necessary to prevent potential data breaches resulting from this directory traversal vulnerability.