A path traversal flaw in WOSDefaultHttpModule.dll permits an attacker to manipulate the request path and access files outside the intended directory when the URL begins with /woshome. The vulnerability can lead to disclosure of sensitive configuration files or other data stored on the server, thereby compromising confidentiality. The flaw stems from improper validation of user‑supplied path components, which is reflected by CWE‑23.

The flaw affects Gladinet Triofox deployments, specifically the WOSDefaultHttpModule.dll component. No specific version ranges are listed in the CNA data; administrators should verify whether they are running any Triofox version that includes this module.

The CVSS score of 7.5 indicates a high severity. Though the EPSS score is not available, the absence of a KEV listing suggests active exploitation is not yet widespread, but the nature of the attack—remote HTTP request—means it can be triggered from anywhere on the network. The likely path to exploitation is an unauthenticated HTTP request to an affected URL; if the attacker can reach the device, they can read arbitrary files. Administrators should consider the risk high due to potential for data compromise.