Logto Tunnel allowed unauthenticated users to request arbitrary file paths by passing a request URL directly into a file open operation without normalizing or validating the path. This path‑traversal flaw in the createStaticFileProxy routine permits reading any file reachable by the tunnel process, potentially exposing configuration data, secrets, or other sensitive content. The vulnerability does not provide execution of arbitrary code but can lead to confidentiality compromise through file disclosure.

The flaw affects the logto-io:logto product, specifically the logto‑tunnel npm package used prior to version 0.3.9. Systems running the tunnel with the "--experience-path" flag enabled and a remotely reachable port are vulnerable. The issue was addressed in release 0.3.9.

The CVSS score of 8.7 denotes a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the tunnel via the exposed listening port; the service accepts unauthenticated requests, so no credentials are required. The path traversal logic is executed server‑side, meaning the attack can be carried out remotely through network traffic directed at the tunnel endpoint. Based on the description, it is inferred that the tunnel port may be reachable from external hosts depending on platform and deployment configuration.