Gridbox EUVD-2026-94934

Exploitation requires that a directory sharing the configured images-root name prefix (e.g. an 'images-backup' sibling of the default 'images' root) already exists on the server AND already contains a file with a Gridbox-permitted image extension; only such image-type files can be read, so this is not arbitrary file disclosure. Key limiting factors: the prefix-only containment bypass only yields files inside an existing prefix-matching sibling directory (none was found on the tested site), the read is restricted to Gridbox image extensions, and direct file streaming only occurs when image decoding is unavailable or fails. No authentication or user interaction is required (PR:N/UI:N), but the AT:P / environmental dependency means default installations without such a sibling directory are not exploitable.

Signals are consistently LOW-to-moderate and mutually reinforcing rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:L only) scores 6.3 Medium, but the AT:P flag is doing important work: successful exploitation depends on a specific environmental precondition (a prefix-matching sibling directory containing a readable image). CISA SSVC independently corroborates the low urgency - Exploitation: none, Automatable: no, Technical Impact: partial - which aligns with the researcher's own decision to rate the finding Low rather than as arbitrary file disclosure. No EPSS score was provided and the CVE is NOT in CISA KEV; no public exploit is referenced. The read primitive is materially constrained to Gridbox image file extensions, so this is not a general file-disclosure bug. Net: this is a genuine but narrow path-traversal weakness, not a high-priority emergency. One caveat to verify with the vendor: the description notes the effective site 'images' root setting was not independently confirmed, and that no prefix-matching sibling directory was actually found alongside the tested site's images directory - meaning real-world exploitability is conditional and may not apply to many deployments.

A remote unauthenticated attacker crafts a showImage request with a traversal path pointing at a sibling directory that shares the images-root prefix (for example images-backup). Because the containment check is prefix-only, the path passes validation, and if image decoding fails the action streams the targeted file directly back to the attacker, disclosing an image stored outside the configured media root. No public exploit code is referenced, and the attack only works where such a prefix-matching sibling directory with a Gridbox-type image already exists.