The vulnerability is a path traversal flaw that leaks arbitrary files from the system through the password field of UnPoller 2.33.0. An attacker who can submit a specially crafted password can read any file on the host that the UnPoller process can access. This grants confidential data leakage and can be used to exfiltrate data over the network. The weakness corresponds to a classic directory traversal weakness that bypasses intended access restrictions. The likely attack vector is remote via the web interface, inferred from the presence of the vulnerable password field.

UnPoller 2.33.0 is the affected version. Users running this exact software version are vulnerable and should verify their installation against newer releases.

The CVSS score is 7.5 while the EPSS score remains <1%; the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that remote attackers can trigger the exploit via the web interface password field. Because the flaw enables reading of any file accessible to the UnPoller process, the risk of data disclosure is high, especially on systems storing sensitive configuration or user data.