The vulnerability resides in the TikZ backend of the Kroki diagram service; when KROKI_SAFE_MODE is enabled the guard only blocks the \verbatiminput primitive, but it still permits native TeX file‑read operations such as \openin, \read, \input, and \include. This oversight lets an attacker craft LaTeX payloads that cause the renderer to read any file the container user can access. The read file contents are rendered directly into the returned SVG, potentially exposing sensitive data such as secrets, credentials, configuration files, or private keys.

The issue affects the open‑source Kroki diagram server produced by Yuzutech. All releases before 0.31.2 are vulnerable, including 0.31.1 and earlier. The problem is present when the backend is configured with KROKI_SAFE_MODE enabled, which was intended to restrict I/O but misses the critical primitives.

The CVSS score of 7.5 signals medium‑high severity. No EPSS data is supplied and the vulnerability is not catalogued in CISA KEV, pointing to a moderate but not negligible exploitation likelihood. An attacker only needs the ability to POST a crafted LaTeX document to the /tikz/svg endpoint or the generic diagram API; no authentication is required. Because the backend runs with the container’s filesystem permissions, a successful payload can read arbitrary files, making the risk significant if the container spirit mounts susceptible directories.