An arbitrary file-system read vulnerability lets an attacker read files on a server that they should not be able to access. The exposed files may include configuration data, source code, logs, credentials, tokens, or other sensitive content. In practice, the bug often appears when an application accepts a file path, identifier, or download parameter and fails to properly restrict which files can be opened.
This matters because file disclosure is often enough to turn a small application flaw into a larger compromise. Attackers can use leaked passwords, API keys, or internal settings to move deeper into the environment, pivot to other systems, or prepare a follow-on attack. Defenders reduce the risk by enforcing strict authorization, normalizing and validating paths, using allowlists, and running services with least privilege so even a successful read attempt cannot access high-value files.