The flaw in DreamMaker is a classic absolute path traversal (CWE-36) that lets an unauthenticated attacker supply a path containing directory‑separators and read the names of files located anywhere on the server’s file system. By sending a specially crafted request over the network, the attacker obtains file names without needing credentials, effectively compromising confidentiality of the server’s file structure. The vulnerability is not a denial‑of‑service or privilege‑escalation flaw; it merely exposes the names of files that the application is permitted to read, which could aid further attacks such as code injection or asset discovery.

Interinfo’s DreamMaker product is affected. No specific version range is listed, meaning any release of DreamMaker should be considered vulnerable until it is updated. The vendor recommends moving to Java Composer 2.3 or later for a fix.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The flaw is exploitable via a simple network request without authentication, so the attack vector is remote over the open network. Because the exploit requires only a basic HTTP request, it could be automated and deployed from a remote host with minimal effort.