The vulnerability allows an attacker to supply path segments in the /docs/*path endpoint that are not properly sanitized, enabling directory traversal through the Rails HTML sanitizer. When exploited, the attacker can read arbitrary .md files located outside the intended docs or static directories, potentially exposing configuration files, credentials, or other sensitive information. This is classified as a path traversal (CWE‑22) flaw that compromises confidentiality.

The flaw exists in the dataCycle‑CORE engine provided by datacycle‑engine for all releases up to and including version 25.07.3. The issue is fixed in 26.06.08.

The CVSS score is 7.5, indicating a high severity. The EPSS score of 0.00603 indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. It can be exploited by an unauthenticated attacker who directs the application to a URL such as /docs/../etc/passwd.md, implying a simple HTTP request is sufficient. The lack of authentication requirements and the high CVSS score make it a significant risk for exposed instances.