This vulnerability involves Local File Inclusion in multiple components of Asseco SEE Live 2.0, specifically through the "path" parameter in the downloadAttachment and downloadAttachmentFromPath API calls. Remote authenticated users can exploit this flaw to read files on the host system. The CVSS vector indicates the attack requires network access with low attack complexity and privileges, no user interaction, and results in high confidentiality impact without affecting integrity or availability. No patch or remediation details are currently provided.

Exploitation of this vulnerability allows remote authenticated users to read arbitrary files on the host system, potentially exposing sensitive information. The confidentiality impact is high, but integrity and availability are not affected. This could lead to information disclosure risks depending on the files accessed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API calls to trusted users only and monitor for suspicious activity related to file access. Avoid exposing these API endpoints publicly if possible.