Navtor NavBox Absolute Path Traversal Vulnerability

A vulnerability allowing absolute path traversal has been identified in Navtor NavBox version 4.12.0.3. This issue arises because the application exposes an HTTP service that does not adequately sanitize user-supplied path inputs. Unauthenticated remote attackers can exploit this vulnerability by sending requests with absolute filesystem paths. Successful exploitation enables the retrieval of arbitrary files from the underlying filesystem, depending on the privileges of the service process. This could result in the exposure of sensitive configuration files and system information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to arbitrary files on the server, potentially including sensitive configuration files and system information.