The vulnerability is a path traversal flaw that allows a remote authenticated user to specify arbitrary file paths, providing access to files outside the intended directory. This can result in the disclosure of sensitive configuration, source code, or other confidential information. The weakness is a classic instance of insecure relative path processing, categorized as CWE‑22.

Census CSWeb version 8.0.1 is the only release identified as vulnerable. The vendor has released a fix in version 8.1.0 alpha. No other products or versions are listed as affected.

The base CVSS score of 8.7 signals a high severity flaw, while the EPSS score of less than 1% and absence from the KEV catalog suggest that exploitation is currently uncommon. An attacker must be authenticated to trigger the vulnerability, after which they can read unintended files. Though no publicly available exploitation code is documented, the high impact warrants swift remediation.