A path‑traversal flaw in 4gaBoards allows an authenticated user with board import privileges to instruct the server to ingest arbitrary files from the host system during a board archive import. Once the file is imported as an attachment, it becomes downloadable through the standard application interface, resulting in unauthorized disclosure of sensitive local files. The vulnerability is limited to accounts that have permission to import boards, and it does not provide remote code execution or elevation beyond that access.

RAGames 4gaBoards versions earlier than 3.3.5 are affected. The vulnerability exists in the import routine of the board archive feature; no other versions or vendors are currently listed as impacted.

The CVSS score is 7.6, indicating a high severity of confidentiality impact. The EPSS score is below 1%, implying a low likelihood of exploitation. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user with board‑import privileges; once such a user practices a traversal attack, they can read any accessible file on the host and then retrieve it via the normal download mechanism.