An improper link resolution vulnerability in zanllp infinite-image-browsing allows unauthenticated remote attackers to perform arbitrary file reads on the host system.

The application suffers from improper link resolution before file access (CWE-59). The to_abs_path function does not sufficiently sanitize paths, allowing an unauthenticated remote attacker to traverse outside of intended directories via symlink manipulation.

This vulnerability enables an attacker to read sensitive files on the server that should be restricted, potentially leading to the disclosure of configuration files, private keys, or system data. Given the CVSS score of 7.5, the impact is severe, as it grants unauthorized read access to the underlying filesystem, compromising the integrity and confidentiality of the entire hosting environment.

Immediate Action: Update to the latest version of infinite-image-browsing where path sanitization logic has been corrected.

Proactive Monitoring: Monitor filesystem access logs for unexpected read requests or attempts to access files outside of defined image directories.

Compensating Controls: Run the application with the least privilege necessary, specifically restricting the filesystem permissions of the user account running the service to prevent access to sensitive system directories.

Public Exploit Available: No

Path traversal vulnerabilities are critical security risks that often lead to full data exposure. Users should apply the available patch immediately and audit their deployment to ensure that the application process is properly containerized or sandboxed.