4gaBoards versions before 3.3.8 contain a path traversal vulnerability (CWE-22) in the GET /exports/:id/:filename endpoint. The filename parameter is decoded and passed to path.join() without proper containment validation, enabling an authenticated project manager to specify traversal sequences (e.g., ../) to access files outside the intended directory. The server returns the contents of the selected file to the attacker. Furthermore, the fileStream close handler calls fs.unlink() on the same path, resulting in deletion of the file, which can lead to data loss or denial of service. The vulnerability is resolved in version 3.3.8.

An attacker with project manager authentication privileges can read arbitrary files on the server and cause deletion of those files, leading to potential data loss and denial of service. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact.

Upgrade 4gaBoards to version 3.3.8 or later, where this path traversal vulnerability is fixed. No other mitigation is required as the fix addresses the root cause.