This vulnerability (CVE-2026-9153) involves improper limitation of a pathname to a restricted directory (CWE-22) in the Rapid7 InsightConnect Sed Plugin on Linux. Authenticated attackers can leverage insufficient input validation of the expression parameter to perform arbitrary file reads. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. No vendor advisory or patch information is currently available, and the affected versions are not explicitly stated.

An authenticated attacker can read arbitrary files on the affected system, potentially exposing sensitive information. The confidentiality impact is high, but integrity and availability are not affected. This could lead to information disclosure but does not directly enable code execution or system disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the InsightConnect Sed Plugin to trusted users only and monitor for suspicious activity related to file access. Follow Rapid7 advisories for updates on patches or official mitigations.