Dell OpenManage Enterprise, versions older than 4.8.0, contains an improper limitation of pathname to a restricted directory vulnerability. An attacker with low privileges on the same local network may supply a crafted path that resolves outside the intended directory, enabling read access to files that should be protected. This leads to the potential exposure of sensitive configuration or credential data, compromising confidentiality. The weakness corresponds to the canonical Path Traversal flaw (CWE‑22).

The affected product is Dell OpenManage Enterprise, deployed by organizations using Dell server management. All installations running a version prior to 4.8.0 are vulnerable; newer releases contain the fix.

The CVSS score of 5.7 indicates a moderate risk when the vulnerable component is exposed over a network. Because the EPSS metric is not available, the current prediction of exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploit. The likely attack vector is a local network attacker with limited privileges who can interact with the OpenManage Enterprise web interface; they could craft a request containing directory traversal sequences to read files outside the allowed area. Based on the description, the attack vector is inferred to be network-based.