MiroFish EUVD-2026-25729

Exploitation requires the get_simulation_posts API endpoint to be accessible over the network without authentication. The vulnerability is triggered specifically by manipulation of the Platform query parameter with path traversal payloads. Exploitation is limited to files readable by the web application process; files with more restrictive permissions or outside the process's accessible filesystem may not be readable. No special configuration or feature enablement is required - the vulnerability exists in the default deployment of affected versions.

This vulnerability presents moderate real-world risk with significant limiting factors. The CVSS score of 5.3 reflects a confidentiality impact with no integrity or availability consequences - attackers can read files but not modify or delete them. The CVSS vector confirms network accessibility (AV:N) and no authentication (PR:N), making it remotely exploitable, but the scope is unchanged (S:U) meaning the impact is restricted to the vulnerable application's own files rather than system-wide. The presence of publicly available exploit code (E:P) increases likelihood of widespread exploitation attempts. However, practical risk depends heavily on what files are accessible via the vulnerable endpoint - if restricted to application data with no sensitive credentials or configuration, impact may be contained. The moderate CVSS score combined with information-disclosure-only impact suggests this is a real but not critical priority; organizations should prioritize patching based on the sensitivity of files potentially exposed through the API.

An attacker crafts an HTTP GET request to the simulation API endpoint with a malicious Platform parameter containing path traversal sequences, such as /api/simulation/posts?Platform=../../../../etc/passwd or Platform=..\..\windows\win.ini, causing the server to read and return sensitive files from the application's filesystem. The attacker may iterate through various paths to discover and exfiltrate configuration files, database credentials, private keys, or other sensitive data stored on the same server.