Host file disclosure via unrestricted credential path

Path traversal in UnPoller 2.33.0 allows local users to read host files and exfiltrate their contents through a configured endpoint. The credential loader strips a file:// prefix from password or API-key values and passes the remaining path to os.ReadFile without an allowlist, then sends the result in a login POST. Exploitation requires write access to up.conf and is limited to files readable by the UnPoller process; the maintainer disputes exploitability without such privilege separation.