A flaw in the Foswiki component Changes/Viewfile/Oops allows an attacker to retrieve sensitive data. The vulnerability is triggered by manipulating an unknown function within this element, and the resulting disclosure can expose configuration or user data that should be private. The disclosure originates from a remote interaction, meaning the adversary does not need local access and can exploit the issue from anywhere the application is reachable.

The affected product is Foswiki, with versions up to 2.1.10 susceptible. All installations of these versions that expose the Changes/Viewfile/Oops endpoint are vulnerable. A patch is available in Foswiki 2.1.11 which removes the vulnerable function.

The CVSS base score of 6.9 reflects moderate severity; combined with an EPSS below 1%, the likelihood of widespread exploitation is low, and it is not currently listed in the CISA KEV catalog. Nonetheless, the vulnerability is publicly known and could be leveraged remotely by an attacker who can identify the endpoint, making it important to address proactively. The absence of a known remediation in the exploitation reports indicates that attackers would need to discover the function first, but the public nature of the exploit suggests that once found, the attack could be automated.