DreamMaker, a product developed by Interinfo, contains a relative path traversal flaw that permits arbitrary file reading. An unauthenticated local attacker can exploit the vulnerability to download any system file accessible to the process. The primary impact is that confidential data, configuration files, or system binaries could be disclosed, potentially facilitating further compromise or providing a foothold for attackers who can gain access to the environment.

The affected product is Interinfo DreamMaker. Specific affected versions are not listed in the available data, so all versions prior to the fix may be vulnerable.

The CVSS score of 8.7 indicates a high severity vulnerability, while the EPSS score is currently unavailable. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need local unprivileged or privileged access to the system running DreamMaker, as the flaw allows reading files without authentication. The lack of a published exploit does not diminish the risk; the ability to read arbitrary files can enable additional attacks such as privilege escalation or reconnaissance of system configuration.