The vulnerability allows a malicious actor to inject the string sequence "/../" into a URL request to traverse directories and read files on the underlying operating system. This creates a disclosure of arbitrary files that were not intended to be publicly available. The weakness is a classic directory traversal flaw (CWE‑22). Misuse can result in exposure of sensitive configuration, credentials, or application code, thereby impacting confidentiality of data stored on the storage system.

IBM Storage Scale Container Native versions 5.2.3.0 through 5.2.3.9 and 6.0.1.0 are affected, as are the CSI standalone implementations 2.14.x and 3.1.x. The issue is present in the "Path" handling of the HTTP interface used by these components.

The CVSS score of 6.5 indicates moderate severity, and no EPSS score is available, so the exploitation probability cannot be quantified at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via HTTP, requiring an attacker to reach the exposed service with the ability to craft and send URL requests. No privileged credentials are required for exploitation, so any external entity with network access to the service may exploit it.