This vulnerability in Softing Industrial Automation GmbH smartLinks allows an attacker to read arbitrary files on the host system. The webserver performs improper URL validation, enabling global file reads through the filesystem modules when accessed from a Docker environment. The weakness is identified as incorrect input validation (CWE‑20) and results in unauthorized disclosure of data that may include sensitive configuration or credential files.

Affected vendor is Softing Industrial Automation GmbH. Products impacted are smartLink SW‑HT and smartLink SW‑PN. The vulnerability exists in all versions up through 1.42 for SW‑HT and up through 1.03 for SW‑PN, as stated by the vendor. Updated versions that contain the fix are smartLink SW‑HT 1.43 and smartLink SW‑PN 1.04.

The CVSS score is 5.3, indicating a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires crafting an HTTP request that bypasses URL checks; authentication or privileged access is not mentioned, so the act of trying likely does not require additional privileges. Because the webserver is network exposed, the vulnerability could be exploited remotely without local access, making it reasonably attractive to attackers.