The logto-io logto Tunnel npm package versions before 0.3.9 have an improper limitation of a pathname to a restricted directory (CWE-22). Specifically, the createStaticFileProxy function passes request URLs directly to path.join and fs.open without normalizing or verifying that the requested path is within the configured static directory. When the --experience-path option is enabled and the tunnel port is reachable, an unauthenticated attacker can exploit this to read files outside the intended directory that are accessible by the logto-tunnel process. The server listens on a port that may be accessible from other hosts depending on deployment, increasing exposure. This issue is resolved in version 0.3.9.

An unauthenticated attacker can read arbitrary files on the system accessible to the logto-tunnel process by exploiting the path traversal flaw. This can lead to disclosure of sensitive information. The vulnerability has a high severity CVSS score of 8.7, reflecting its network attack vector, no required privileges or user interaction, and high impact on confidentiality.

This vulnerability is fixed in logto version 0.3.9. Users should upgrade to version 0.3.9 or later to remediate this issue. No official remediation level or patch link is provided, but the vendor has addressed the flaw in the stated version. Until upgrading, restricting access to the tunnel port and disabling the --experience-path option can reduce exposure.