The vulnerability is an incorrect access control in the config.php component of Slah. Because the file is accessible without authentication, an attacker can retrieve its contents, which contain sensitive data, including active session credentials. This flaw corresponds to improper access control (CWE‑284) and results in information exposure (CWE‑200). The exposure can compromise confidentiality and potentially allow further attacks if session data is grabbed.

Slah version 1.5.0 and all earlier releases are affected. No additional product or version information is available from the CNA.

The CVE has a CVSS score of 7.5, does not report an EPSS score, and is not listed in the CISA KEV catalog, indicating no public exploitation data is known. Based on the description, it is inferred that an attacker can trigger the flaw by directly requesting the /config.php URL over HTTP, which would return the plaintext configuration file. Exploitability is low to moderate because it requires network access to the web server and no authentication is needed, but the impact is critical due to the sensitive data exposed.