IBM Aspera High-Speed Transfer Endpoint versions 3.7.4 through 4.4.7 Fix Pack 1 contain a CWE-22 path traversal vulnerability in the asperahttpd component. An authenticated user may leverage this flaw to access files outside the intended directory restrictions on the server's local storage. This vulnerability impacts confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact.

An authenticated attacker can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive information stored locally. There is no indication of impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to limit access to sensitive files and monitor for unusual file access patterns related to the asperahttpd component.