The vulnerability resides in Garmin’s local web server component, known as Garmin WDU, which improperly handles symbolic links in uploaded graphics packages. An attacker can upload a malicious package containing symlinks that point to any file on the device. When the server processes the upload, it follows those links and serves the target contents. Because the server does not enforce a sandbox or restrict link targets, this behavior lets the attacker read any file that the web server process can access, exposing configuration files, stored credentials, or other sensitive data. The flaw is a classic file‑system disclosure vulnerability and does not directly enable remote code execution, but the exposed data could undermine device security and privacy.

The flaw is present in Garmin WDU firmware versions 1.4.6 (v1) and 5.0 (v2). These versions are used in a range of Garmin devices that include a local web interface for managing graphics or content. No other vendors or product variations are indicated in the CNA data. If a device is still running either of these firmware versions, it is susceptible to this file‑disclosure attack.

A CVSS score of 7.5 indicates high severity, and the EPSS score is less than 1%, suggesting a low but non‑zero exploitation probability. Because the vulnerability requires the attacker to have network access to the device’s local web interface and the ability to upload a graphics package, the attack vector is likely local or within an unsecured local network. Nonetheless, the potential impact of leaking arbitrary files is significant for confidentiality and could facilitate further attacks or reveal user data. The vulnerability is not listed in CISA’s KEV catalog, but it remains a noteworthy information‑disclosure risk for devices running the affected firmware.