Vertex, a management tool for Private Tracker users, suffers from a path traversal flaw that allows an attacker to read files located outside of the intended directory. This vulnerability can lead to the disclosure of sensitive configuration files or application code, compromising system confidentiality.

The vulnerability exists in all Vertex releases preceding commit fbde301b97986d5913fc4bc95f5445750d282e11. Any deployment using those builds is susceptible, regardless of whether Vertex is accessed locally or exposed through a web interface.

The CVSS score of 8.6 classifies the flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. Nevertheless, because the flaw permits arbitrary file reads through user-supplied paths, it can be triggered by any authenticated or potentially unauthenticated user with access to the Vertex interface, based on the description it is inferred that such users could exploit the path traversal. Properly configured permissions and the absence of other mitigating controls could amplify the impact, making this a critical issue to address promptly.