File Thingie 2.5.7 contains a directory traversal flaw that allows a malicious user to read any file on the target system by abusing the "create folder from url" capability. The weakness is a classic directory traversal (CWE-22) that can expose sensitive configuration, credentials, or code. This vulnerability does not directly lead to code execution but can compromise confidentiality and potentially aid in further attacks if exposed files contain exploitable data.

The flaw affects the version 2.5.7 of File Thingie, as identified by the vendor "leefish". No other product versions are noted as impacted in the available data.

With a CVSS score of 4.3 the risk is moderate, and the EPSS score is below 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is via the web interface that exposes the "create folder from url" feature, so an attacker would need access to the application, either through a normal user account or an unauthenticated session that permits the feature. This inference is based on the description of the feature and the nature of the flaw.