An attacker can manipulate the filename argument supplied to the download_export_file function in the tools.py module of the WeRSS we-mp-rss application. By providing a crafted value that contains directory traversal sequences, the function resolves to files outside its intended directory and returns their contents. This flaw allows arbitrary file read, potentially exposing sensitive configuration files, credentials, or confidential data. The vulnerability is classified as CWE-22 and is exploitable remotely via the exposed HTTP API.

Versions of rachelos WeRSS we-mp-rss up to 1.4.8 are affected. The flaw resides in the download_export_file endpoint of api/tools.py. Systems running these versions, regardless of whether the application is exposed to the internet or an internal network, are at risk when the API is reachable. Updating to a patched version beyond 1.4.8 removes the vulnerable code path.

The CVSS base score of 5.3 indicates moderate severity, but the path traversal flaw is remotely exploitable and an exploit has already been published. The EPSS score is below 1%, indicating a relatively low likelihood of widespread exploitation at the current time. However, because the flaw can drive reading of arbitrary files, an attacker can obtain highly sensitive data if the application runs with elevated permissions or accesses secure directories. The vulnerability is not listed in CISA's KEV catalog, so no known widespread exploitation has been reported yet.