The vulnerability is a classic unauthenticated path traversal flaw defined by CWE‑22, which permits the reading of files located outside the intended data/uploads/app‑icons directory. Because there is no traversal or boundary validation on the filename parameter in the /api/app-icons/[filename] endpoint, an attacker can retrieve arbitrary files on the host. This leads to confidential data exposure and the reuse of session tokens, undermining the integrity and confidentiality of user sessions. The flaw is identified as CWE‑200, further reinforcing the risk of sensitive information disclosure.

The issue affects the self-hosted jotty·page application from fccview, specifically versions earlier than 1.22.0. The vulnerable API endpoint is /api/app-icons/[filename] used to serve application icons for checklists and notes.

The CVSS score of 8.2 indicates a high severity. Because no authentication is required, the attack vector is trivial for anyone able to issue HTTP requests to the target endpoint. The EPSS score is not available, but the lack of an authentication requirement and the straightforward string manipulation suggest a high likelihood of exploitation. The vulnerability is not listed in CISA KEV, but it warrants immediate attention due to its potential impact.