An Absolute Path Traversal flaw in Navtor NavBox allows unauthenticated attackers to read any file on the filesystem that the service process can access. The flaw arises because the HTTP service accepts user-supplied path components without proper sanitization. Successful exploitation can expose configuration files, credentials, and system secrets, compromising confidentiality and potentially integrity of the environment.

The vulnerability affects Navtor NavBox, specifically version 4.12.0.3 as referenced by the vendor advisory. No other versions were listed, so cases running that exact build are impacted unless updated.

The CVSS score of 7.5 reflects a high impact with limited privileges. EPSS indicates a low probability (<1%) of exploitation at the time of this assessment, and the advisory is not included in the CISA KEV catalog. Attackers can exploit the flaw remotely without authentication by sending crafted file-path requests to the exposed HTTP endpoint. As the flaw only requires valid network connectivity to the service, safeguarding the service or applying a patch is critical.