From version 2.4.0 up to, but not including, 2.13.0, the Pode framework’s static route handling allowed an attacker to request arbitrary filesystem paths in the URL. By supplying paths such as \/c:\\Windows\\System32\\drivers\\etc\\hosts, the application responded with the file’s contents. This flaw provides confidential disclosure of any file readable by the server process, potentially exposing system configuration, credentials, or code. The weakness corresponds to CWE‑22: Path Traversal.

The affected product is Badgerati’s Pode, a cross‑platform PowerShell web framework. Versions from 2.4.0 through all releases prior to 2.13.0 are vulnerable. Later releases (2.13.0 and beyond) contain the fix.

The CVSS score of 6.9 classifies the flaw as moderate severity. While the EPSS score is not available, the maintenance status of the product and the direct ability to read arbitrary files over HTTP mean that exploitation is likely practical. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote over the network; an unauthenticated client can craft a URL to the static route and retrieve any file the server process can read.