EnergizeLab station‑middleware images 1.6.5 through 1.8.2, built on NestJS, contain an authenticated path‑traversal flaw that lets any registered low‑privilege user read arbitrary files on the host. The vulnerability is a classic file‑path validation failure (CWE‑73) and permits disclosure of middleware configuration, source code, and potentially server secrets, leading to credential theft and further compromise. The vulnerability carries a CVSS score of 9.9, indicating a severe risk when exploited.

The affected product is EnergizeLab’s station‑middleware Docker image, version range 1.6.5 to 1.8.2. Systems that run these images without the latest update are vulnerable; the flaw is present in all Docker builds of the specified versions.

Because the flaw requires an authenticated low‑privilege account, attackers with any user credentials can exploit it; the EPSS score is not available, but the high CVSS score indicates that once accessed, the impact is significant. The vulnerability is not listed in the CISA KEV catalog, suggesting that known exploitation evidence is limited, yet the lack of a weakness mitigated by user input validation means requirement for immediate action. The likely attack vector is through the middleware’s exposed file‑reading API or a similarly designed endpoint, where a crafted path is supplied. Exploitation does not require additional privileges beyond those granted to the user account.