This vulnerability permits attackers to read the contents of a sensitive directory and all its subdirectories without requiring any authentication, as stated in the description. Based on the description, it is inferred that the application does not enforce access controls for that directory, allowing attackers to retrieve files that may contain confidential information. Consequently, the confidentiality of the data stored in that directory is compromised while its integrity and availability remain unaffected.

The issue affects the Pro-Bit application versions before 1.77.4. Users running any edition of the software prior to that release are potentially impacted. The CVE description does not specify vendor or product sub-categories beyond the generic Pro-Bit identifier, and no further version details are provided.

The CVSS score of 7.5 indicates a high level of risk, and the lack of authentication requirements is explicitly stated in the CVE description. Based on the description, the presence of an exposed directory suggests that exploitation could occur in the real world, despite the EPSS score being < 1%. The likely attack vector appears to be direct access to the exposed URL path, which may be available over the network or locally, as no privilege escalation is required. The vulnerability is not listed in CISA’s KEV catalog, meaning no catalogued exploits are known, but this does not lower its potential impact.