The affected software contains a path traversal flaw in the /getExternalResource endpoint. An authenticated viewer can supply a crafted path parameter that includes parent-directory segments, enabling reading of any file with an allowed extension (js, json, html) outside the intended solution directory. The flaw bypasses the application's per-resource access controls, allowing disclosure of sensitive files such as configuration data, source code snippets, or other proprietary content. This weakness is classified as CWE-22.

Helical Insight 7.0.0, released by Helical Insight, is affected by this path traversal vulnerability. The flaw is present in the 7.0.0 release; earlier or later revisions may or may not be impacted, but no specific version range beyond 7.0.0 is listed.

The CVSS score of 5.3 indicates moderate severity. Because the EPSS score is not available, the probability of widespread exploitation remains uncertain, but the absence of an entry in the CISA KEV catalog suggests no publicly known exploits yet. An attacker can achieve the flaw by authenticating as any viewer role and sending a GET request to /getExternalResource with a crafted path parameter, such as '../appsettings.json', to read restricted files. The vulnerability operates over the network and does not require privileged local access.