A path traversal flaw exists in the _default HTTP handler of BrowserStack Runner. The bug allows attackers to supply crafted file paths to the server, causing the application to read files outside the intended project directory. Because there is no authentication guard, the flaw leads directly to confidentiality compromise by exposing arbitrary local files. The core weakness is classified as CWE‑22.

The vulnerability affects all BrowserStack Runner versions up to and including 0.9.5. The product is identified by the CNA as browserstack:browserstack-runner and is hosted in a Node.js environment where the server binds to all network interfaces.

With a CVSS score of 7.1, the exploit presents a high medium risk. The EPSS is not available, and the issue is not listed in the CISA KEV catalog, indicating no current known exploitation data. Attackers can reach the vulnerable server via any network interface that the HTTP listener exposes, so the likely attack vector is a local or network‑adjacent threat actor who can connect to the machine running the runner. Given the lack of authentication, a simple HTTP request is sufficient to read sensitive files, making the risk significant for any host exposing BrowserStack Runner to the network.