A local file disclosure vulnerability exists in callstack's agent-device versions 0.21.36 before 0.21.37. Authenticated remote users can exploit this flaw by sending an open command with a file:// URL through the /rpc interface, then issuing a snapshot command to read plaintext files accessible by the daemon account. This vulnerability allows unauthorized reading of files on the host system.