The vulnerability resides in MineAdmin version 1.x and 2.x, where the getFileInfoById function in /system/getFileInfoById can be manipulated by altering the ID argument to reveal files that should not be exposed. This flaw enables unauthorized disclosure of potentially sensitive data through the web interface. The flaw is classified as an information exposure (CWE‑200) coupled with improper access control (CWE‑284), allowing attackers to retrieve content beyond permitted scopes.

Any deployed instance of MineAdmin 1.x or 2.x is affected. Both CPE strings for version 1.0 and 2.0 indicate that all releases within these major branches are susceptible, while newer major versions beyond 2.x are not listed.

The CVSS base score of 2.3 reflects a low severity threat, and the EPSS score of less than 1% indicates a very small likelihood of real‑world exploitation given the current awareness. The vulnerability is not included in the CISA KEV catalog, suggesting no widespread confirmed exploits. However, the attack can be launched remotely by an adversary who can direct the target’s web server to request a crafted file ID; the attack requires a high level of complexity and is considered difficult to execute, but a public proof‑of‑concept is available, raising the possibility of future exploitation if the software is not updated.