A directory traversal flaw exists in Gleez GleezCMS version 1.2.0 within the action_serve function of media.php. This flaw allows an attacker to manipulate file path parameters and read files outside the intended directory, potentially exposing sensitive system files or configuration data.

The vulnerability affects installations of GleezCMS, specifically version 1.2.0. No other product versions are reported as impacted.

The CVSS score is not provided and the EPSS value is unavailable, making quantitative risk assessment difficult. The flaw is not listed in CISA's KEV catalog. Because the traversal attack can be performed remotely without authentication, the risk of exploitation is significant, especially on exposed web servers that run this application.