An absolute path traversal flaw in MeetingHub allows an unauthenticated remote attacker to read arbitrary files from the underlying system. The vulnerability can be triggered by crafting URLs that reference directories outside the intended file location, enabling disclosure of sensitive configuration and credential files. The impact is primarily confidentiality loss, and the flaw is quantified with a CVSS score of 8.7 indicating high severity.

HAMASTAR Technology’s MeetingHub is affected. All releases prior to the patch version 20251210 are vulnerable. The patch releases MeetingHub 20251210 or later contain the fix; any earlier versions remain at risk.

The CVSS base score of 8.7 signals a critical exposure, yet the EPSS score is below 1%, implying a low rate of observed exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely used in the wild. An attacker can exploit the flaw over the network by sending crafted requests without authentication, as no client-side authentication is required to trigger the file read.