A path traversal flaw exists in the log filtering feature of Riverbed SteelHead VCX appliances, allowing an authenticated user to provide specially crafted filter expressions that the backend parser expands and uses to read arbitrary files on the system. The vulnerability permits disclosure of sensitive files through the web‑based log viewer, representing a confidentiality breach (CWE‑200).

Riverbed Technology’s SteelHead VCX appliances, confirmed on model VCX255U running firmware 9.6.0a, expose this flaw through the management interface’s log_filter endpoint.

The CVSS score of 7.1 indicates a moderate to high risk, while an EPSS score of 65% signals a relatively high likelihood that the flaw might be actively exploited. Exploitation requires valid credentials to the management web interface, after which a crafted filterStr parameter is submitted to the log_filter endpoint and the server expands file references, leaking the requested file content. The vulnerability is not listed in CISA’s KEV catalog, but the combination of high exploitation probability and moderate severity warrants swift action.