An unauthenticated attacker can exploit the web‑based management interface of HPE Aruba Networking Fabric Composer to read files that reside within the affected directory. The flaw does not grant code execution but can expose configuration, credential or other sensitive files, thereby compromising confidentiality and potentially enabling further attacks.

HPE Aruba Networking Fabric Composer is impacted. No specific version range is supplied, so all released versions of the product should be considered vulnerable until a vendor notification clarifies the scope.

The CVSS score of 7.5 indicates moderate‑to‑high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to reach the web interface without authentication, an attack vector common to many web management ports.