The vulnerability in HomeGallery allows an attacker to request a file download outside the intended media directory because the application does not verify the file’s location. This path traversal flaw enables arbitrary file reads, exposing sensitive system files such as configuration data and operating system files, thereby compromising confidentiality. The flaw exists in the download request handling and can potentially allow anyone with access to the download endpoint to retrieve arbitrary files.

The issue affects the HomeGallery application from xemle, specifically all releases before 1.21.0. Users running any version earlier than 1.21.0 are susceptible.

With a CVSS score of 8.6 the vulnerability is considered high severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the vulnerability has not been listed in the CISA KEV catalog. The attack vector appears to be remote, via the publicly accessible download endpoint, and requires no special privileges or authentication. While the potential impact is significant, the low probability of exploitation mitigates overall risk, though the flaw remains exploitable if access to the download endpoint is possible.