This vulnerability (CWE-22) in QuantumCloud Conversational Forms for ChatBot allows improper limitation of a pathname to a restricted directory, enabling path traversal attacks. This can lead to unauthorized reading of files outside the intended directory scope. The affected versions include all versions up to 1.1.8. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation can lead to unauthorized disclosure of sensitive files on the affected system, compromising confidentiality. There is no impact on integrity or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to file access. Avoid exposing the vulnerable component to untrusted networks if possible.