This vulnerability in DriveLock's web service allows an attacker to read files on the server by submitting a crafted path. Because the service fails to validate the user‑supplied path, an authenticated user can request arbitrary files and receive their contents, exposing sensitive data. The flaw is a classic directory traversal that enables confidential information disclosure from the context of the service account.

All installations of DriveLock that expose the built‑in web service on TCP port 4568 are affected. The vendor brand is DriveLock, and no specific version number is listed in the advisory, so every deployed instance should be reviewed for this issue.

The advisory assigns a CVSS score of 6.5, which reflects a moderate severity threat. EPSS of 2 % indicates a low likelihood of widespread exploitation at present, and the vulnerability is not yet listed in CISA KEV. Exploitation requires authentication, so only users who have legitimate login credentials can leverage the flaw. An attacker who compromises an account can craft requests that include path traversal sequences, causing the service to read files beside its intended directory and return their contents in the HTTP response.