Anatoly Download Counter versions up to 1.4 suffer from an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This allows an unauthenticated attacker to craft requests that access files outside the designated directory boundaries, potentially exposing sensitive data. The vulnerability is remotely exploitable without requiring user interaction or privileges, impacting confidentiality but not integrity or availability.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive files on the server hosting Anatoly Download Counter. The attacker can read arbitrary files outside the intended directory scope, which may include configuration files, credentials, or other sensitive information. There is no indication that integrity or availability are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application, implementing web application firewalls with path traversal detection, and monitoring for suspicious requests targeting file paths. Avoid exposing the application to untrusted networks if possible.