bird-lg-go is a BIRD looking‑glass application written in Go that accepts a file path argument via its API. Prior to version 1.4.7 the input path is not properly validated, allowing an attacker to construct a request that resolves to an arbitrary local file. Because the application runs with the permissions of the host process, an unauthenticated attacker can read any file reachable from the process, including critical system files such as /etc/shadow and user history files. This vulnerability directly results in disclosure of highly sensitive information and can be used as a foothold for further compromise.

The vulnerability applies to the xddxdd:bird-lg-go product. Any deployment of bird‑lg‑go with a version earlier than 1.4.7 is affected. The fix is provided in release 1.4.7 and later.

The CVSS score of 7.5 indicates a high severity risk. The EPSS score is not available, and the issue is not currently listed in the CISA KEV catalog, suggesting no known exploitation yet. However, the threat model is clear: an unauthenticated remote attacker who can access the application’s HTTP interface can send a crafted request to retrieve arbitrary files. This lack of input validation makes the vulnerability easily exploitable in environments where the service is exposed to the internet or an untrusted network.