A path‑traversal flaw in Rundeck allows users who have only the project configure ACL to read any file on the server by setting the "resources.source.N.config.file" attribute to an absolute path. The contents of these files can be returned through the editProjectNodeSourceFile operation or the apiSourceGetContent endpoint, potentially exposing database credentials, LDAP bind passwords, and other confidential project data. This weakness compromises confidentiality by letting an attacker read arbitrary server files.

Vulnerable versions of the Rundeck platform prior to 6.2.0 are affected. Affected products include the Rundeck core application, as identified by the CNA vendor rundeck:rundeck. No additional version or patch information is provided beyond the pre‑6.2.0 range.

The CVSS base score of 7.1 indicates a high‑severity risk. No EPSS score is available, and the vulnerability is not currently listed in the CISA KEV catalog, but the flaw can be exploited by any actor who can reach the configured project via the web UI or API, making it potentially remotely exploitable. The attack requires only the project configure permission, which is commonly granted, so the likelihood of exploitation is non‑negligible in environments that have exposed the Rundeck instance without additional access restrictions.