This vulnerability (CWE-22) in SICK AG Baggage Analytics permits an attacker to bypass pathname restrictions and access files outside the intended directory scope. By brute forcing folder and file names, an unauthorized remote attacker with low privileges can read sensitive files, including private keys and configuration data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation allows unauthorized disclosure of sensitive information stored in files outside the restricted directory, potentially compromising private keys and configuration files. This can lead to information leakage but does not affect system integrity or availability. The medium CVSS score reflects the significant confidentiality impact balanced by the requirement for low privileges and no known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected application and monitor for unusual file access patterns. Avoid exposing the application to untrusted networks. Do not assume the vulnerability is mitigated without vendor confirmation.