Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows attackers to supply a file: URL to the downloadUrl parameter of the saveYZJFile endpoint and read any file on the host. This flaw also lets attackers make the application request internal HTTP(S) resources, enabling SSRF. The impact is direct access to sensitive files such as /etc/passwd or configuration files, and the potential exposure of credentials and internal network resources.

The vulnerability affects the Weaver e-Bridge product. No specific product versions are listed in the CVE entry, so all deployed versions of e-Bridge could be impacted until a vendor patch is released.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, but the exploit evidence from the Shadowserver Foundation in October 2023 indicates real-world activity. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote unauthenticated traffic since the saveYZJFile endpoint is publicly accessible and does not perform authentication checks before processing the downloadUrl parameter.