Typemill versions prior to 2.24.0 contain a path traversal flaw that lets an authenticated user with Author privileges read any file outside the content directory. The weakness is a file‑system access control bypass (CWE‑22) triggered by traversal sequences in the path query used by Storage::getFile() when no folder argument is supplied. This permits disclosure of credential files, configuration files, or other sensitive data that resides outside the intended directory.

The vulnerability affects the Typemill content‑management system, specifically all installations of typemill:typemill running a version earlier than 2.24.0. The correct level of remediation is to upgrade to version 2.24.0 or later.

The CVSS score of 7.1 indicates a high impact on confidentiality for authenticated attackers. The EPSS score is reported as less than 1%, showing a very low probability of observed exploitation at this time, and the issue is not listed in the CISA KEV catalog. Attackers need Author‑level access and to supply a crafted path parameter; once the path is provided, the application bypasses its usual folder‑path validation.