The vulnerability is a classic directory traversal flaw that permits a remote attacker to construct a malicious image parameter and read arbitrary files from the system hosting Follett Library Manager. Because the parameter is processed without proper validation, the attacker can access sensitive configuration or credential files as well as other system data.

Users of Follett Software’s Destiny Library Manager version 22_0_2_rc1 are affected. The flaw is fixed by the 22.5 AU1 release and all later versions. No other product or vendor is explicitly reported as impacted.

The flaw is reachable via a remote request to the image parameter, with no authentication required. EPSS is not available and the vulnerability is not listed in the KEV catalog, so the likelihood of widespread exploitation is uncertain, but the CVSS score of 7.5 indicates a medium‑to‑high severity, underscoring the potential for significant data disclosure if exploited.