The vulnerability occurs in the Mongoose embedded web server and network library. Prior to version 7.22, an attacker who can control an SSI‑enabled file can insert directory traversal sequences into an #include or #include virtual directive. The mg_ssi() function concatenates the directive argument into a filesystem path without sanitization, enabling arbitrary file reads by the process that runs Mongoose. This path traversal flaw allows the disclosure of any file that the server process can read.

The affected product is the Cesanta Mongoose library distributed under the name mongoose. All releases before 7.22 are vulnerable. This includes embedded applications that ship the old library or compile from older source.

The CVSS score for this issue is 6.5, indicating a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need the ability to create or modify an SSI‑enabled file that the web server will serve; if these conditions are met, they can cause an arbitrary file read. The flaw relies on unsanitized path construction, so the exploit would read any file accessible to the Mongoose process.