A flaw in the Centreon Open Tickets module on the Central Server on Linux permits an attacker to supply a specially crafted file path that contains directory traversal characters. The application fails to properly validate or canonicalize the path, enabling the attacker to read files located outside the intended directory on the underlying Linux file system. Identified as CWE-22, the vulnerability can expose sensitive configuration data, credentials, or other confidential files, thereby creating a serious risk of information leakage and potential use in further attacks if the attacker gains additional foothold.

Centreon Open Tickets modules installed on a Centreon Central Server running Linux are impacted for all releases older than versions 25.10.3, 24.10.8, or 24.04.7.

The CVSS base score of 9.9 classifies the flaw as Critical, indicating high potential impact. An EPSS score of less than 1% suggests the current probability of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known active exploit. The attack vector is likely remote, via the Centreon web interface, where a malicious user can submit a crafted path to the Open Tickets API to read sensitive files.