A path‑traversal flaw exists in the _read_events_tail function of the Delete Request Handler in adenhq Hive. The flaw allows an attacker to manipulate a request to reference arbitrary files on the host, potentially exposing sensitive data. The vulnerability is identified as CWE‑22 and can be triggered remotely, after which the attacker can read any file the application user can access.

All installations of adenhq Hive up to and including version 0.11.0 are affected. The exposed code resides in core/framework/server/routes_sessions.py within the Delete Request component. No other products or versions are listed. Administrators of environments running these versions should verify deployment and seek remediation.

The CVSS v3.1 score is 6.9, indicating a moderate severity. EPSS is not available, and the vulnerability is not in the CISA KEV catalog, suggesting low to moderate exploitation activity. Because the attack vector is inferred to be remote, an attacker could issue a crafted request to the Delete endpoint to read arbitrary files if the server does not enforce strict path validation. Until a patch is applied, the risk remains at the stated moderate level.