The vulnerability allows an attacker or a lower‑privileged component that can influence the configured secrets directory to create a symbolic link pointing outside that directory. The NestedSecretsSettingsSource will follow that link when loading secret values, resulting in arbitrary local file reads. Additionally, the same code path bypasses the documented secrets_dir_max_size limit, allowing the attacker to read a file regardless of its size. This flaw is a classic path traversal issue (CWE‑22) combined with unvalidated read size (CWE‑400) and improper symlink handling (CWE‑59).

The product affected is Pydantic‑Settings, version 2.12.0 up through but not including 2.14.2. Any deployment using a version in this range is vulnerable.

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1 % indicates a low likelihood of exploitation at present. The vulnerability is not present in CISA’s KEV catalog. Exploitation requires that the attacker or untrusted process has write access to the secrets directory in order to create or modify a symbolic link that points outside the intended path. The flaw is local and does not provide remote code execution, but it can lead to data disclosure by exposing file contents and bypassing size limits.