Helical Insight CVE-2026-111635

Requires an authenticated session at viewer privilege or higher; this is not remotely exploitable without credentials despite the network attack vector. The attacker must reach the /getExternalResource endpoint and supply parent-directory segments in the path parameter. Exploitation is further limited to reading files whose extension is in the allowed set (js, json, html) - binary secrets, arbitrary extensions, and write/modify actions are not possible. There is no confidentiality exposure of files with disallowed extensions, and no integrity or availability impact. The condition is a product-inherent flaw in /getExternalResource, so no non-default configuration is needed beyond having a valid low-privilege account.

This is a medium-severity information-disclosure issue, not an urgent priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and shows only limited confidentiality impact (VC:L) with no integrity or availability impact - consistent with a read-only path traversal whose reach is further constrained to files with allowed extensions (js, json, html). The PR:L metric confirms exploitation requires an authenticated account (a 'viewer' per the description), which meaningfully lowers real-world risk versus an unauthenticated flaw. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no exploitation signal is present, so there is no evidence of active exploitation. The referenced hackmd link is titled for an 'efwd parameter SQLi' issue, which appears unrelated to this /getExternalResource path traversal - verify it is not mislabeled; the authoritative source here is the VulnCheck advisory and the linked EFWController.java source. Overall: a genuine but bounded authenticated-read vulnerability, appropriate for routine patching rather than emergency response.

An authenticated user with only viewer-level privileges sends a request to /getExternalResource with a path parameter containing parent-directory sequences (e.g. ../../), causing the server to return a readable file outside the intended solution directory as long as it carries an allowed extension (js, json, html). This lets a low-privilege account read configuration or source files it should not access, bypassing the per-resource access controls. No public exploit code specific to this path traversal was identified, though the VulnCheck advisory documents the vulnerable code path.