MiniGal Nano versions 0.3.5 and prior contain a CWE-22 path traversal vulnerability in the index.php script through the dir parameter. The application appends user input to the photos directory and tries to block traversal by removing '..' sequences. However, this filtering is insufficient and can be circumvented using specially crafted directory patterns. This allows an attacker to cause the application to access and display image files outside the intended directory, leading to unintended information disclosure of files readable by the web server.

An attacker can exploit this vulnerability to enumerate and view image files located outside the intended photos directory on the server. This results in unintended disclosure of potentially sensitive information accessible to the web server user. There is no indication of privilege escalation, remote code execution, or other impacts beyond information disclosure.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, consider restricting web server permissions to limit access to sensitive directories and avoid exposing the vulnerable MiniGal Nano versions publicly.