This vulnerability in 6Storage Rentals (<= 2.20.2) is caused by missing authorization checks, which allows a path traversal attack. An attacker with low privileges can exploit this issue remotely over the network without user interaction to read sensitive files. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, and high confidentiality impact but no integrity or availability impact.

Successful exploitation could lead to unauthorized disclosure of sensitive information due to path traversal without requiring user interaction. There is no impact on data integrity or system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official 6Storage communications for updates. Until a fix is available, restrict access to the affected application to trusted users only and consider additional access controls to limit exposure.