This vulnerability involves improper limitation of a pathname to a restricted directory (path traversal) in the Barcode Scanner with Inventory & Order Manager product. The issue affects all versions up to 1.9.0 and allows an attacker with high privileges to access files outside the intended directory scope. The CVSS 3.1 base score is 4.9, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No known exploits are reported in the wild, and no patch or vendor advisory is provided.

An attacker with high privileges can exploit this vulnerability to read sensitive files outside the intended directory restrictions, potentially exposing confidential information. There is no impact on system integrity or availability. Since exploitation requires high privileges, the risk is limited to users who already have significant access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and monitor for suspicious activity related to file access. Avoid exposing the vulnerable software to untrusted networks or users with elevated privileges.