The vulnerability in LORIS's static file router permits an attacker to request files outside the intended directory. By manipulating the URL to the static, css, and js endpoints, the attacker can traverse the file system and download arbitrary files, exposing sensitive data. This issue is a classic path traversal flaw, identified as CWE‑552, and can lead to confidentiality breaches if the application serves privileged content.

Affected products include the open‑source LORIS platform by aces. Versions from 20.0.0 up to, but not including, 27.0.3 and up to, but not including, 28.0.1 are vulnerable. The security fix was released in 27.0.3 and 28.0.1. Users running any earlier releases should verify their installed version before applying the fix.

The CVSS score of 7.5 indicates a high impact risk. Although the EPSS score is not available and the vulnerability does not appear in the KEV catalog, the ability to read any file from the server via a public HTTP endpoint suggests that the attack can be performed remotely without authentication. The exploit path is straightforward: crafting a URL that includes path traversal sequences which the router fails to sanitize. Due to the lack of authentication or rate limiting, the exploitation likelihood remains significant, especially in environments where LORIS is exposed to untrusted users.