Northern.tech Mender Server versions 4.1.0, 4.0.1, and earlier contain a directory traversal vulnerability (CWE-22) that could allow an attacker with low privileges to read files outside the intended directory structure. This vulnerability is fixed in versions 4.1.1 and 4.0.2. The CVSS v3.1 base score is 3.1, reflecting a low severity with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact. No known exploits have been reported.

The vulnerability allows limited unauthorized access to files outside the intended directory, potentially exposing sensitive information. The impact is limited to confidentiality with no integrity or availability effects. Given the low CVSS score and absence of known exploits, the risk is considered low.

Upgrade affected Northern.tech Mender Server installations to version 4.1.1 or 4.0.2 where this directory traversal vulnerability is fixed. Patch status is confirmed by the version fixes mentioned; no additional vendor advisory details are available. No other mitigation steps are specified.