QuantumCloud Conversational Forms for ChatBot contains an improper limitation of a pathname to a restricted directory (CWE-22), enabling path traversal attacks. Versions from initial release up to 1.1.8 are affected. The vulnerability allows remote attackers to read arbitrary files by manipulating file path inputs. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation can lead to unauthorized disclosure of sensitive files on the affected system, compromising confidentiality. There is no impact on integrity or availability according to the CVSS vector. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious file access attempts. Avoid exposing the vulnerable component to untrusted networks if possible.