MiniGal Nano versions up to 0.3.5 possess a path traversal flaw in index.php. The application concatenates the dir parameter to a photos directory and attempts to block traversal by removing '..' but this safeguard can be bypassed with crafted directory patterns. An attacker can exploit the flaw to enumerate and display image files from unintended filesystem locations that are readable by the web server, leading to unintended information disclosure. This weakness corresponds to the identified Common Weakness Enumeration identifier CWE-22.

The vulnerability affects MiniGal:MiniGal Nano, specifically versions 0.3.5 and earlier.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% reflects a very low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is the web application’s index.php endpoint, which accepts a user-supplied dir parameter. By sending a crafted HTTP request that manipulates the dir value, an attacker can bypass the directory traversal protection and obtain file listing or content from directories on the host that the web server can read. Successful exploitation would result in the disclosure of potentially sensitive files, limited only by the web server’s file permissions.