This vulnerability (CWE-22) in Linknat VOS Manager permits unauthenticated remote attackers to perform path traversal attacks by injecting encoded sequences such as '%c0%ae%c0%ae' into localized subpaths like '/eng/', '/chs/', or '/cht/'. This bypasses input validation and allows reading arbitrary files on the server. It affects versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds. The CVSS 4.0 score is 8.7, reflecting network attack vector, no required privileges or user interaction, and high confidentiality impact. The product is a cloud service, and the vendor is responsible for patching.

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the server, potentially disclosing sensitive information. The vulnerability has a high confidentiality impact but does not require privileges or user interaction. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Since VOS Manager is a cloud service, the vendor manages remediation server-side. Users should verify with Linknat Technology's official advisory that their service instance has been updated to a patched version (2.1.9.07 or later). No additional user action is required if the vendor confirms mitigation.