The vulnerability is a classic path‑traversal flaw that allows an authenticated project manager to craft a filename that resolves to any file readable by the server process. By supplying a traversal sequence such as "../" the attacker can retrieve arbitrary files from the server’s disk. After the file is streamed back to the attacker, the same path is passed to the filesystem unlink routine, causing the file to be deleted. This leads to potential data loss and denial of service, and the impact scales from a single file to system‑wide files based on the server’s permissions and the target user’s file mapping. The flaw is rooted in CWE‑22, a canonical path‑traversal weakness.

The affected product is 4gaBoards by RARgames. All releases prior to version 3.3.8 are vulnerable. No specific minor versions are enumerated beyond the latest tag v3.3.8 which includes the fix.

The CVSS score of 8.8 classifies this as high severity. No EPSS value is reported, so the exploitation probability is uncertain but the flaw does not require special configuration or remote code execution, only authenticated access to the export endpoint. The exploit path is straightforward: an authenticated user issues a GET request to /exports/:id/:filename with a crafted traversal filename. The file read is returned in the response, then the server deletes the file via the close handler. The vulnerability is not listed in the CISA KEV catalog, but the lack of a published exploit does not diminish the risk of data loss or service interruption.