A parameter manipulation flaw in the /api/file/download endpoint of ThingsGateway 12 allows attackers to craft a fileName value containing directory traversal characters. The traversal enables arbitrary file reads on the underlying host, exposing sensitive files such as configuration files, logs, and potentially credentials. The vulnerability does not provide direct code execution but leaks confidential data that could assist in more serious attacks. The flaw carries a CVSS score of 5.3, indicating moderate severity.

ThingsGateway version 12 is affected. The vulnerability resides in the /api/file/download API. No version ranges or specific build details are provided beyond version 12. The vendor, ThingsGateway, has not released a patch or response, leaving systems based on this version at risk.

The exploit is publicly available and can be triggered by sending a malformed fileName parameter over HTTP, with no authentication mentioned. The EPSS score is under 1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low probability of widespread exploitation. However, the combination of remote file read capability and an available exploit code means that attackers still have a feasible attack path, especially in environments where the endpoint is publicly exposed.