OpenDeck, software for Elgato Stream Deck, allows attackers to read arbitrary files due to an uncensored path traversal in the static file service that listens on port 57118. By including '../' sequences in the request path, a malicious client can traverse outside the intended plugin directory and access any file that the OpenDeck process can read. This introduces a confidentiality breach, enabling disclosure of sensitive data such as configuration files, logs, or other local files.

All installations of OpenDeck earlier than version 2.8.1 are affected, regardless of deployment environment. The vulnerability exists in the service that serves static files for installed plugins, and the affected product is the OpenDeck application from vendor nekename.

The vulnerability carries a CVSS v3 score of 5.9, indicating moderate risk. The EPSS score is below 1%, suggesting low exploitation likelihood. It is not listed in the CISA Known Exploited Vulnerabilities catalogue. Based on the description, it is inferred that a remote attacker can send a specially crafted HTTP request to the service listening on port 57118, taking advantage of the improper sanitization of path components to traverse directories and read any file accessible to the OpenDeck process.