This vulnerability in Vedo Suite 2024.17 arises from improper input sanitization in the readfile() function call within the /api_vedo/video/preview API endpoint. Authenticated remote attackers can leverage this flaw to perform local file inclusion, enabling them to read arbitrary files on the server's filesystem. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges (authenticated), no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation allows an authenticated remote attacker to read arbitrary files on the server hosting Vedo Suite 2024.17. This can lead to disclosure of sensitive information, potentially compromising confidentiality. There is no impact on integrity or availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint to trusted users only and monitor for suspicious activity involving file access. Avoid exposing the /api_vedo/video/preview endpoint to untrusted networks. Follow vendor updates closely for any released patches or official mitigations.