OpenDeck is a Linux-based software designed to interface with Elgato Stream Deck devices, providing plugin support and static file serving over a network service listening on port 57118. Prior to version 2.8.1, OpenDeck's file-serving component improperly handles pathname sanitization, specifically failing to restrict directory traversal sequences such as '../' in HTTP request paths. This flaw allows an unauthenticated remote attacker to craft requests that traverse outside the intended plugin directories and access arbitrary files on the host system that the OpenDeck process can read. The vulnerability is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-24 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The CVSS 4.0 vector indicates network attack vector (AV:N), high attack complexity (AC:H), no privileges required (PR:N), user interaction required (UI:A), and impacts confidentiality with high scope impact (VC:H, SI:L, SA:L). Although exploitation requires user interaction, the attacker does not need authentication, making it a significant risk for exposed OpenDeck services. No known exploits are currently reported in the wild. The vulnerability is resolved in OpenDeck version 2.8.1 by proper path sanitization and validation to prevent directory traversal.

This vulnerability allows attackers to read arbitrary files on systems running vulnerable OpenDeck versions, potentially exposing sensitive configuration files, credentials, or other private data accessible by the OpenDeck process. For organizations using OpenDeck in production or streaming environments, this could lead to information disclosure, aiding further attacks or espionage. Since the service listens on a network port, any exposed instance could be targeted remotely. The requirement for user interaction slightly reduces risk but does not eliminate it, especially in environments where users might be tricked into initiating malicious requests. The impact on confidentiality is high, while integrity and availability are not directly affected. The medium CVSS score reflects the moderate ease of exploitation and the scope of affected systems. Organizations relying on OpenDeck for streaming or automation should consider the risk of data leakage and potential lateral movement within their networks.

The primary mitigation is to upgrade OpenDeck to version 2.8.1 or later, where the vulnerability is fixed. Until upgrade is possible, organizations should restrict network access to port 57118 using firewalls or network segmentation to limit exposure to trusted users only. Monitoring and logging access to the OpenDeck service can help detect suspicious path traversal attempts. Additionally, running OpenDeck with the least privileges necessary reduces the impact of potential file disclosure. Employing host-based intrusion detection systems (HIDS) to alert on unusual file access patterns may also help. Educate users about the risks of interacting with untrusted content that could trigger malicious requests. Finally, consider disabling the static file serving feature if it is not required for operational purposes.