A relative path traversal flaw in Interinfo DreamMaker allows a privileged local attacker to read any file on the underlying system. The vulnerability is a classic CWE‑23 "Path Traversal" flaw that can compromise confidentiality by exposing sensitive files such as configuration data, user credentials, or system binaries. The impact is limited to attackers who already have local execution privileges, but the ability to read arbitrary files can enable further lateral movement or escalation if system files are accessed.

The flaw affects Interinfo DreamMaker. No specific product versions are listed in the data, so all unreleased or earlier releases prior to the vendor’s update may be vulnerable. The vendor’s recommended remediation is to upgrade to Java Composer 2.3 or later, which includes the necessary fix.

The CVSS score of 6.9 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. The attacker must have local privileged access to exploit the path traversal; therefore the primary risk is internal attackers or those who gain local control. Once the application is updated, the risk is eliminated.