A relative path traversal vulnerability in 4MOSAn Management Center versions prior to 20260621 allows unauthorized file access and poses a significant security risk.

The product is susceptible to CWE-23 (Relative Path Traversal), which allows an unauthenticated, remote attacker to manipulate file paths and access sensitive information on the server.

Path traversal vulnerabilities can lead to the exposure of sensitive configuration files, source code, or internal system data. Given the CVSS score of 7.5, this vulnerability is considered high risk because it allows an unauthenticated attacker to bypass security controls and read arbitrary files from the filesystem, directly impacting the confidentiality of the affected infrastructure.

Immediate Action: Upgrade to version 20260621 or later and perform the necessary security upgrades for the FreeBSD-GCB Management Center.

Proactive Monitoring: Review server access logs for patterns indicative of directory traversal attempts, such as sequences containing dot-dot-slash.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal patterns in incoming HTTP requests.

Public Exploit Available: No (no confirmed public exploit identified).

The vulnerability is urgent due to the lack of authentication required for exploitation. Administrators must apply the vendor-provided patch immediately to prevent unauthorized access to the underlying system files.