DriveLock is vulnerable to a directory traversal flaw that allows a remote attacker to read arbitrary files through the web service listening on port 4568. The flaw arises from improper validation of user-supplied paths before file operations, enabling disclosure of sensitive data without any authentication. The weakness is categorized under CWE‑22 and can reveal confidential information that is accessible to the service account, potentially including configuration files, credentials, or user data.

The affected product is DriveLock by DriveLock. No specific version range is listed in the advisory, so any installation that includes the web service on TCP port 4568 is potentially impacted.

The CVSS score of 7.5 indicates a high severity, and the EPSS score of 2% shows a low to moderate probability of exploitation. The vulnerability can be triggered remotely without authentication, making it attractive for attackers. Although the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, the combination of high impact and low technical barriers makes it a significant risk in exposed environments.