A flaw in Cisco Identity Services Engine and its Passive Identity Connector component permits an authenticated user to conduct path traversal on the underlying operating system. The flaw arises from inadequate validation of user‑supplied HTTP parameters, enabling the attacker to request arbitrary files after authentication. The consequence is the potential disclosure of sensitive configuration or credential files, effectively compromising confidentiality for accounts with administrative privileges. While authentication is required, the lack of further checks means any compromised admin can read protected files.

The vulnerability affects Cisco ISE and Cisco ISE-PIC. No specific version information is listed, indicating that all released versions remain vulnerable until a patch is applied.

The CVSS score of 4.9 reflects a moderate impact with limited attack surface. No EPSS score is available and the flaw is not listed in the KEV catalog. Exploitation requires valid administrative credentials, so the risk is largely confined to environments where such access is possible. Because no public exploitation has been reported, the threat is controlled by access management and timely patching.