The vulnerability exists in the mg_ssi() function of the cesanta mongoose embedded web server and network library before version 7.22. When SSI (Server Side Includes) is enabled, an attacker controlling an SSI-enabled file can insert directory traversal sequences in #include file or #include virtual directives. The function mg_ssi() concatenates these directives into filesystem paths without validating them using mg_path_is_sane(), allowing unauthorized file disclosure. This improper limitation of pathname to a restricted directory is classified as CWE-22. The issue is resolved in mongoose version 7.22.

An attacker with the ability to control an SSI-enabled file can exploit this vulnerability to read arbitrary files accessible by the Mongoose process. This can lead to disclosure of sensitive information. The CVSS score of 6.5 (medium severity) reflects the network attack vector with low complexity and no user interaction required, but requires some privileges (PR:L). There is no indication of integrity or availability impact.

This vulnerability is fixed in mongoose version 7.22. Users should upgrade to version 7.22 or later to remediate this issue. No official patch or temporary fix details are provided beyond this version update. Until upgrading, restricting access to SSI-enabled files and limiting permissions of the Mongoose process may reduce exposure.