DreamMaker by Interinfo contains a CWE-23 relative path traversal vulnerability that permits privileged local attackers to perform arbitrary file reads. This vulnerability allows attackers with local access and elevated privileges to exploit the path traversal flaw to download arbitrary files from the system. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality. No official patch or remediation level has been published, and the product is not a cloud service.

The vulnerability enables attackers with privileged local access to read arbitrary system files, potentially exposing sensitive information. There is no indication of remote exploitation or impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local privileged access to trusted users only to mitigate risk. Monitor vendor communications for updates on patches or mitigations.