The vulnerability is a path traversal flaw in the /api/v1/file/content endpoint where the filename parameter is concatenated to the config path without sanitization. An attacker who can authenticate to the service can craft filenames with ../ to read or create files outside the intended config directory, potentially accessing TLS private keys, OAuth tokens, or any file readable by the container. This can lead to disclosure of sensitive data, credential compromise, and full system takeover. The weakness corresponds to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Affected product is GoDoxy, a reverse proxy and container orchestrator developed by yusing. Versions earlier than 0.27.5 are vulnerable. The vulnerability affects any installation exposing the API endpoint, regardless of deployment environment, as the flaw exists in the core file handling logic. Users running environments with the ConfigBasePath set to the relative "config" directory are included.

The CVSS score is 6.5, indicating a medium severity. EPSS is below 1%, suggesting a low exploitation probability. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires valid authentication to the service, but once authenticated, the attacker can bypass confinement and access or modify arbitrary files within the container. Because the payload does not require privilege escalation prior to authentication, the risk to the entire host depends on the container's UID and privileges. The vulnerability is likely to be exploited through the exposed API endpoint over the network.