The flaw lies in the ImageCacheController, where user‑provided filenames are not properly validated. An attacker can supply specially crafted path traversal sequences as the filename parameter, enabling unauthenticated remote access to files located outside the intended image directory. Authorized reading of arbitrary files such as configuration, credentials, or source code may result, compromising confidentiality and potentially facilitating further attacks.

Webkul Bagisto version 2.4.1 is affected. The vulnerability is fixed in Bagisto v2.4.2 and later. No other versions have been reported as vulnerable.

The CVSS score of 8.7 indicates a high severity. Because the flaw is exploitable remotely without authentication, the attack surface is broad. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA KEV, but the high CVSS suggests substantial risk. Exploitation requires sending a crafted HTTP request to the image cache endpoint with a filename containing traversal sequences; no additional privileges or network access restrictions are needed.