WGDashboard contains a flaw that allows an attacker to read arbitrary files on the host’s file system without any authentication. The vulnerability stems from missing input validation and authentication checks, resulting in a confidentiality breach. An attacker who can reach the dashboard’s web interface can trigger the flaw and obtain sensitive configuration or credential files, enabling further attacks or lateral movement.

All installations of WGDashboard earlier than version 4.3.2 are affected. Any instance that has not applied the latest release carries this risk.

The CVSS score of 9.3 indicates a very high impact and potential for exploitation. The EPSS score is not available; however, the lack of a KEV listing suggests that no mass exploitation has yet been reported. Based on the description, it is inferred that an attacker who can reach the dashboard’s web interface can trigger the flaw, potentially without needing elevated privileges. Once exploited, arbitrary file reading is possible, providing a pathway for privilege escalation or data exfiltration. The vulnerability remains high risk until patched.