The Brushfire Online Experience platform's video streaming application leaks the database path in user requests. This information disclosure vulnerability allows remote, unauthenticated attackers to read sensitive system information about other users. The issue is categorized as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The vulnerability was publicly disclosed with a CVSS 4.0 base score of 6.9 (medium severity). Although the description states the issue was fixed in February 2026, no specific patch details or affected versions are provided. The vulnerability does not require user interaction or privileges and has no known exploits in the wild.

An attacker can remotely and without authentication access sensitive system information, specifically the database path, which may aid in further attacks or reconnaissance. The exposure of such internal system details can compromise user privacy and system security. However, there is no indication of direct code execution or privilege escalation from this vulnerability alone.

The vulnerability was fixed in February 2026 according to the description. However, no explicit patch or remediation details are provided. Users of the Brushfire Online Experience platform should ensure they are running the latest version released after February 2026. Since this is not a cloud service, remediation depends on applying vendor updates. Patch status is not yet confirmed in vendor advisories; check official Brushfire communications for current remediation guidance.