Systemic Risk Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in Systemic Risk versions through 2.8.0. The issue arises in the GetFile.aspx endpoint, where an unauthenticated attacker can exploit the vulnerability by supplying a crafted file path in the ReportUrl parameter. This exploitation allows the attacker to read arbitrary system files, potentially exposing sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information through the reading of arbitrary system files.