The vulnerability in KDE Arianna’s bookserver allows an attacker to read arbitrary files by guessing a URL over a socket connection. This provides unauthorized access to potentially sensitive data on the system. The weakness is a Missing Authentication for Sensitive Functionality flaw (CWE‑306), meaning the server does not require proper credentials before allowing file reads.

KDE Arianna is affected in all releases prior to 26.04.1. The issue exists in the bookserver component and does not apply to versions 26.04.1 and later, which already contain the fix.

The CVSS score of 4 indicates moderate severity, and the EPSS score of less than 1% suggests exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog, further implying limited exploitation activity. Attackers would need network or local access to the socket used by the bookserver; the likely vector is sending crafted URLs to the socket, bypassing authentication due to the design flaw.