A path traversal vulnerability in zanllp infinite-image-browsing allows unauthenticated remote attackers to read arbitrary files from the host filesystem.

The application improperly validates pathnames within the scripts/iib/api component. This path traversal flaw allows an unauthenticated attacker to bypass directory restrictions and access files outside the intended web root.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive configuration files, credentials, or system data. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to data confidentiality, potentially facilitating further network compromise.

Immediate Action: Update the infinite-image-browsing software to a version beyond 1.8.0 that incorporates the fix provided in commit 4057a624c7a23a36f0b4dc6a545b40767d602450.

Proactive Monitoring: Monitor server access logs for requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the api endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block path traversal attempts and normalize URI inputs to prevent malicious directory navigation.

Public Exploit Available: Unknown.

The presence of a proof-of-concept necessitates immediate attention to this vulnerability. Administrators should prioritize upgrading the affected software to the latest patched version to eliminate the path traversal vector and prevent unauthorized filesystem access.