The path traversal flaw in plugNmeet‑Server’s whiteboard conversion endpoint permits any meeting participant to supply a crafted filePath containing "../" sequences. The server then processes the referenced text or office document, converts it into page images, and exposes those images for download without requiring additional authentication. The result is an attacker can read arbitrary files stored on the server, compromising confidentiality. No evidence indicates that the flaw enables remote code execution or denial of service; the primary impact is data disclosure.

The vulnerability is limited to mynaparrot’s plugNmeet‑server product, versions through 2.5.2 inclusive. All installations running plugNmeet‑Server 2.5.2 or earlier may be susceptible. Upgrading beyond 2.5.2 removes the flaw.

With a CVSS score of 7.1, the vulnerability is classified as medium severity. An attacker who can join a meeting gains the ability to trigger the conversion endpoint. The exploit requires only the ability to craft the filePath parameter, which does not need administrative privileges, making the attack vector likely to be a simple API request from a participant’s client. The EPSS rating is unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating no public exploitation has been documented. Nonetheless, the relative ease of exploitation and potential for exposure of sensitive files suggest a moderate to high risk for affected deployments, especially if the server hosts confidential data.