pydantic-settings versions from 2.12.0 up to and including 2.14.2 contain a path traversal vulnerability (CWE-22) in the NestedSecretsSettingsSource feature. When secrets_nested_subdir is set to true, symbolic links within the secrets_dir that point outside the directory are followed, enabling reading of files outside the intended secrets directory. This behavior also circumvents the secrets_dir_max_size protection, potentially allowing excessive data to be loaded. An attacker or lower-privileged component with write or influence over the secrets directory can exploit this to read arbitrary local files into settings. The vulnerability is addressed in version 2.14.2.

An attacker or lower-privileged component able to modify or influence the contents of the configured secrets directory can exploit this vulnerability to read arbitrary local files outside the intended secrets directory. This can lead to unauthorized disclosure of sensitive information. Additionally, the bypass of the loading-size cap may allow excessive resource consumption. The CVSS score is 5.3 (medium severity), indicating limited but meaningful confidentiality, integrity, and availability impacts.

This vulnerability is fixed in pydantic-settings version 2.14.2. Users should upgrade to version 2.14.2 or later to remediate this issue. No official patch or temporary fix is indicated beyond upgrading. Until upgraded, ensure that the secrets directory is not writable or modifiable by untrusted or lower-privileged users to reduce exploitation risk.