The vulnerability resides in DreamFactory Core version 1.0.3, specifically the RestController component. An attacker can supply a malicious URI path that is not properly sanitized, resulting in a directory traversal exploit. This allows unauthorized read access to files outside the intended web root, potentially revealing configuration files or other sensitive data and enabling further compromise. The weakness is a classic path traversal issue.

DreamFactory Core v1.0.3. The affected vendor is DreamFactory Software.

The CVSS score of 7.2 indicates a medium to high severity. The EPSS score is below 1%, suggesting low probability of active exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to send crafted HTTP requests to the vulnerable endpoint; no authentication is required as the path is not validated, making remote exploitation straightforward once the web interface is reachable.