DriveLock Directory Traversal Information Disclosure Vulnerability permits remote attackers to read any file accessible to the service account via the web service on TCP port 6067. The flaw arises from missing validation of user-supplied paths before file operations, enabling disclosure of sensitive system files. Authentication is not required, so any host with network reach to the service can exploit the vulnerability.

The vulnerability affects all installations of DriveLock that expose the web service on its default port 6067. No specific product versions are listed in the advisory, but the issue applies to the components referenced in the CNA advisory.

The CVSS score of 7.5 signals high severity, indicating significant confidentiality impact if exploited. An EPSS score of 2% suggests a low but existent likelihood of exploitation in the wild. DriveLock is not present in the CISA KEV catalog, and no widespread exploitation reports are documented. The flaw can be triggered remotely by sending crafted HTTP requests to the vulnerable service; authentication is not required, so the attack can originate from any network host that can reach TCP port 6067.