The vulnerability is a path traversal flaw that leaks arbitrary files from the system through the password field of UnPoller 2.33.0. An attacker who can submit a specially crafted password can read any file on the host that the UnPoller process can access. This grants confidential data leakage and can be used to exfiltrate data over the network. The weakness corresponds to a classic directory traversal weakness that bypasses intended access restrictions.

UnPoller 2.33.0 is the affected version. Users running this exact software version are vulnerable and should verify their installation against newer releases.

Exact CVSS and EPSS scores are not provided; the vulnerability is listed as not present in the CISA KEV catalog. The exploit requires remote interaction with the web interface password field, suggesting remote attackers can trigger it from outside the local network. Because the flaw enables reading of any file accessible to the UnPoller process, the risk of data disclosure is high, especially on systems storing sensitive configuration or user data.