This vulnerability in PMWeb affects the file downloader.aspx functionality by allowing remote attackers to manipulate the FullFileName/FileName parameter to perform path traversal attacks. This can potentially allow unauthorized access to files outside the intended directory. The issue impacts PMWeb versions 7.x, 8.x, and 2025.x. The vendor has not provided a response or patch, and public exploit code exists. The CVSS 4.0 vector indicates the attack requires no privileges or user interaction and has low complexity, with partial impact on confidentiality.

Successful exploitation could allow an attacker to read arbitrary files on the affected system by traversing directories via the vulnerable parameter. This may lead to disclosure of sensitive information. There is no indication of privilege escalation, integrity, or availability impact. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing access controls or input validation on the affected parameter as a temporary mitigation. Monitor for updates from the vendor.