The vulnerability is a path‑traversal flaw in novaGallery, allowing unauthenticated users to craft image URLs that point to files outside the gallery root directory. By substituting directory traversal sequences in the album and cached image routes, an attacker can retrieve image files located elsewhere on the server. The disclosed data are limited to image files, potentially revealing sensitive visual content that may have been unintentionally exposed.

Novafacile novagallery versions older than 2.1.1 are affected. The 2.1.1 release contains the fix that removes the vulnerable route handlers and validates requested paths against the gallery root.

The CVSS base score of 5.3 indicates a moderate risk. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The flaw can be exploited through unauthenticated HTTP requests to the album or cached image endpoints by supplying path traversal sequences; the attacker only gains read access to image files located outside the intended root, not arbitrary server files.