This vulnerability is a relative path traversal flaw in Apache Ignite's REST HTTP API. When a user has authenticated API access, the 'cmd=log' endpoint accepts a log path argument that can be crafted to traverse directories and read arbitrary files present on the server. This flaw is identified as CWE‑23 and allows a privileged attacker to obtain sensitive configuration files, credentials, or other confidential data, compromising confidentiality but not integrity or availability directly.

Affected is the Apache Ignite platform, distributed under the Apache Software Foundation. All releases from version 2.0.0 up through 2.17.0 contain the unpatched 'cmd=log' handling that permits directory traversal. Versions 2.18.0 and later provide the patch that sanitizes the input path or removes the insecure endpoint.

The flaw carries a CVSS score of 8.5, indicating high severity. EPSS is not available, but the lack of a KEV listing suggests no widespread exploitation to date. Based on the description, the attack requires legitimate REST API credentials; an attacker who can obtain or guess these credentials can use the vulnerable endpoint to read any file the Ignite process can access. The vulnerability is exploitable without specialized network conditions beyond the standard REST interface, so the risk to environments where Ignite is exposed externally, or where forged tokens are possible, is significant.