The vulnerability stems from the way the application normalises requested paths using os.path.normpath, which removes dot segments but does not resolve symbolic links. A symlink created inside a directory that the application scans can therefore point to a file outside that directory. This type of flaw is a path traversal / file inclusion weakness identified as CWE-59. The containment check performed by is_path_trusted compares the path string, not the resolved target; consequently FileResponse follows the symlink when serving the file, allowing an attacker to read arbitrary files such as /etc/passwd. The flaw exists wherever the access control flag is enabled, which occurs in network‑exposed WebUI deployments that use share, ngrok, listen or server_name. A standalone run without those options serves every readable file regardless of this defect, but the primary risk is focused on exposed deployments.

This issue affects the open‑source Infinite Image Browsing plugin provided by zanllp. The description references code located in scripts/iib/api.py and scripts/iib/tool.py, and the vulnerability is present in the 1.8.0 release and earlier. No specific version range is listed, but any deployment running the vulnerable code base before the realpath fix is affected.

The CVSS score of 8.7 indicates high severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog. An attacker would need the ability to create a symlink inside a scanned directory, which can be achieved via file upload or local write access within the application’s context. Once in place, the attacker can read arbitrary files on the host system with the same privileges as the running process. The flaw is exploitable in network‑exposed deployments, making remediation urgent to prevent remote file disclosure.