IBM Aspera High‑Speed Transfer Endpoint and Server versions 3.7.4 through 4.4.7 Fix Pack 1 contain a flaw in the asperahttpd component that enables an authenticated user to read files from the server’s local file system that they should not have access to. This represents a confidentiality breach where sensitive data could be disclosed to accounts with legitimate access to the service but without permission to view the underlying files. The weakness is identified as a path traversal type flaw, corresponding to CWE‑22.

The affected products are IBM Aspera High‑Speed Transfer Endpoint and IBM Aspera High‑Speed Transfer Server. Vulnerable builds include all releases starting at 3.7.4 and up through 4.4.7 Fix Pack 1. Any system running these versions is at risk until remediation is applied.

The CVSS score of 6.5 indicates a medium‑severity vulnerability. Because the exploit requires authentication, the attack vector is limited to users who already have valid credentials to the Aspera service. The EPSS score is not available, so the current probability of an active exploit is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known attacks have been reported to date. Nonetheless, an authenticated attacker could read arbitrary files, potentially exposing confidential information or enabling lateral movement within the infrastructure.