A path traversal flaw in the Statamic file dictionary fieldtype enables an authenticated Control Panel user to manipulate the filename configuration parameter and read arbitrary .json, .yaml, or .csv files on the server. This vulnerability, classified as CWE-22, results in unauthorized disclosure of sensitive data such as configuration settings or credentials, compromising confidentiality without affecting integrity or availability.

The issue affects Statamic CMS versions earlier than 5.73.14 and 6.7.0. The affected component is the file dictionary fieldtype within the Control Panel. Administrators running these versions should be aware that any authenticated user can trigger the flaw.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score is below 1%, meaning exploitation is unlikely in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector requires an authenticated Control Panel user to submit a crafted filename to the affected endpoint; the flaw permits read‑only access, making confidentiality the primary concern.