A path traversal flaw in the WebUI management agent of WatchGuard Fireware OS lets a person who can authenticate as an administrator read or list files anywhere on the device. The flaw permits local file disclosure without remote code execution or privilege escalation beyond the credentials used to log in. The weakness is classified as CWE-22 and CWE-23, both describing unrestricted file path traversal. Because arbitrary files can be accessed, confidential data could be exposed and the system could be compromised if sensitive configuration or credential files are read.

WatchGuard Fireware OS devices. The vendor has released fixes in several recent firmware releases, including 12.5.21, 12.12.3, 2026.2.3 and 2026.3.2. Systems running earlier or non‑patched versions are affected, and should be upgraded to one of these supported builds.

The CVSS score of 8.2 indicates high severity with a potential for significant impact. The EPSS score is not available, so the expected exploitation frequency cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a valid administrator account or other privileged access, so the threat surface is limited to administrators with access to the WebUI. Nevertheless, because the attack needs only a crafted request and grants read access to arbitrary local files, it presents a serious risk if the credentials are compromised or the management interface is exposed to untrusted networks.