EnergizeLab Station-Middleware EUVD-2026-102433

Attacker must hold any valid registered low-privilege account on the station-middleware application (PR:L) and must be able to reach the service over the network. The specific trigger is a request parameter that the application uses as an attacker-controlled file path, which the backend resolves without adequate restriction (CWE-73), allowing reads outside intended directories. Limiting factors: exploitation is confined to Docker image versions 1.6.5 through 1.8.2; it requires authentication (not anonymous); and realistic impact depends on sensitive files (configs, secrets, keys) being present on the reachable filesystem. No special non-default feature toggle is named in the description.

Signals conflict and should be reconciled before treating this as a top-tier emergency. The supplied CVSS 3.1 base score is 9.9 (Critical) with AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, but the description and CWE-73 (External Control of File Name or Path) describe only an arbitrary file READ that 'exposes middleware files and server secrets' - a pure confidentiality impact. The provided I:H and A:H are therefore not supported by the stated behavior and appear overstated; an honest base metric set (C:H, I:N, A:N) yields roughly Medium severity, not 9.9 - verify impact scope with the vendor. No EPSS score, no CISA KEV listing, and no confirmed public exploit are present in the input, so there is no evidence of active or automatable exploitation. Exploitation also requires a valid registered low-privilege account (PR:L), which removes this from the 'unauthenticated internet-wide' category. The realistic priority is moderate-to-elevated specifically for organizations running the affected Docker image versions where untrusted users can register accounts; the secrets exposure can enable follow-on lateral movement, which is what justifies prompt patching despite the single-dimension direct impact.

An attacker obtains or registers an ordinary low-privilege account on an exposed EnergizeLab station-middleware instance and issues an application request containing an attacker-controlled file path (e.g., pointing at configuration, environment, or key material on the container/host). The service returns the file contents, leaking server secrets that can then be reused to escalate or pivot. A GitHub reference in the input may host proof-of-concept tooling, but its contents are unverified from the provided data.