A cleartext storage flaw in ash‑project’s AshPaperTrail allows an attacker who can read a generated version resource to recover sensitive data stored in nested embedded values, unions, or lists. The lack of redaction for attributes deeper than the top level means credentials, tokens, and other secrets remain written to the version table in plain text. This vulnerability is classified as CWE‑312, with the primary impact being the exposure of confidential information that can be extracted without additional effort once read access is obtained.

The product in question is AshPaperTrail, managed by the ash‑project. Vulnerable releases include any version from 0.3.0 up to, but not including, 0.7.0. Earlier pre‑0.3.0 releases and later 0.7.0 or newer releases are not affected. The flaw stems from the :redact and :ignore options only acting on top‑level attributes and never descending into embedded, union, or list structures, so sensitive fields nested inside those structures are written to the audit table in cleartext.

The CVSS score of 5.9 indicates moderate severity, but the EPSS score is not available, leaving the exploitation likelihood uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers need only read access to a generated version resource, a privilege typically granted to authenticated users who audit logs or version history. Once this access is available, all sensitive fields embedded in complex structures can be recovered, leading to a data breach. The flaw does not provide privilege escalation or arbitrary code execution; its consequence is limited to data exposure.