CrowdStrike LogScale Self‑Hosted is affected by a critical unauthenticated path traversal flaw that allows an attacker to read arbitrary files from the server filesystem. The vulnerability is triggered by a specific cluster API endpoint; no authentication is required, meaning any remote host that can reach the endpoint can request file contents. This capability results in a confidentiality breach and is reflected in the high CVSS score of 9.8, indicating a severe risk to systems that expose the vulnerable endpoint.

The flaw impacts the CrowdStrike LogScale Self‑Hosted product; specific affected versions are not disclosed in the advisory, so all customers running the reported self‑hosted release should assume they are vulnerable. Next‑Gen SIEM customers are explicitly excluded, and SaaS customers have been protected through network‑layer blocks applied by the vendor.

The CVSS score of 9.8 classifies this vulnerability as critical, and although an EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the absence of exploitation evidence does not diminish the threat. Attackers can reach the exposed cluster API endpoint remotely and retrieve sensitive files without authentication, which is the most likely attack vector. If the endpoint is exposed, the exploitation conditions are minimal: no privileged credentials or special network access are required.