CVE-2019-14671

CVE-2019-14671 describes a local file enumeration vulnerability in Firefly III version 4.7.17.3. This flaw allows an attacker to discover local files on the system due to insufficient sanitization of protocol schemes, specifically file:/// URLs, within the fints_url configuration. The vulnerability has a low CVSS score of 3.3, indicating a low severity. An attacker would require local access and low privileges to exploit this, with the primary impact being the disclosure of local file paths, not their content or modification. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered minimal community attention and media coverage, suggesting a low likelihood of widespread exploitation.