This vulnerability in Eleveo Quality Management 9.7.0 involves a path traversal flaw in the Scorecard.jsp file of the Questionnaire Audio Upload component. An attacker with limited privileges can remotely exploit this flaw to manipulate file paths, potentially accessing files outside the intended directory. The vulnerability is publicly disclosed, but no vendor response or patch has been provided. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

Successful exploitation could allow an attacker with limited privileges to read or access files outside the intended scope, potentially exposing sensitive information or system files. The impact is limited but could lead to information disclosure or further attacks depending on the accessed files. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official Eleveo channels for updates. Until a fix is available, restrict access to the affected component and limit user privileges to reduce exposure.