The vulnerability CVE-2025-34517 affects Ilevia Srl.'s EVE X1 Server firmware versions ≤ 4.7.18.0.eden. It is an absolute path traversal issue (CWE-22) in the get_file_content.php script, enabling attackers to bypass directory restrictions and read arbitrary files on the server. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality. The vendor has explicitly declined to patch this vulnerability and recommends customers not expose the affected service port (8080) to the internet as a mitigation.

Successful exploitation allows remote attackers to read arbitrary files on the EVE X1 Server without authentication, potentially exposing sensitive information. There is no indication of privilege escalation, integrity, or availability impact. The vulnerability is exploitable over the network without user interaction or privileges, making it a significant confidentiality risk.

No official patch or fix is available as the vendor has declined to service this vulnerability. The vendor recommends that customers do not expose port 8080 to the internet to reduce exposure. Organizations should implement network-level controls such as firewall rules or VPN access to restrict access to the affected service. Monitor for any suspicious activity targeting this vulnerability.