UnForm Server Manager versions prior to 10.1.12 contain an unauthenticated file read vulnerability (CWE-22) via the arc endpoint's fl parameter. This parameter is used to specify log files for analysis but lacks proper input validation and path sanitization, enabling attackers to perform path traversal attacks. By supplying relative paths, attackers can access arbitrary files on the server, including sensitive operating system files, without needing any authentication. The vulnerability is publicly disclosed with a CVSS 4.0 score of 9.2, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality and security capabilities. No patch or official remediation details are currently available, and the product is not a cloud service.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the host system running UnForm Server Manager, potentially exposing sensitive operating system files and confidential data. This compromises confidentiality and could lead to further system compromise depending on the accessed files. The vulnerability is critical due to its unauthenticated nature and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the UnForm Server Manager interface to trusted users only and monitor for suspicious activity. Avoid exposing the vulnerable endpoint to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.