The vulnerability arises when group posts contain a free‑form screen field. The API concatenates the database‑controlled screen value with the application’s source directory without sanitizing it. This allows an attacker who can supply post data—either through the administrative editor or by importing from a malicious RansomLook instance—to include path‑traversal sequences such as ../config/generic.json. When the post is later retrieved, the application resolves and reads the attacker‑controlled file, returning its Base64‑encoded contents through the API. The effect is an arbitrary file read that can expose configuration files, API credentials, password hashes, or other secrets that are readable by the RansomLook process. The weakness is a classic directory‑traversal flaw classified as CWE‑22.

RansomLook RansomLook. The affected version is any release before the code change that adds realpath verification. No specific version range is listed.

The flaw carries a CVSS score of 8.2, indicating high impact. No EPSS data is available, but the vulnerability is not listed in CISA's KEV catalog. An attacker does not need a user account on the target; it only requires the ability to supply a manipulated post, which is possible by editing posts as an admin or by importing from a compromised upstream instance. The absence of mandatory path validation makes exploitation straightforward, and the read capability could allow disclosure of privileged data with full read permissions of the RansomLook process.