This vulnerability exists in the addAccountHeadAndDetail endpoint of jshERP (up to version 3.6). Specifically, the fileName argument in the addAccountHeadAndDetail function of AccountHeadService.java can be manipulated to perform path traversal attacks. This allows an attacker to potentially access files outside the intended directory structure. The vulnerability can be exploited remotely without user interaction and requires low privileges. The issue was reported early to the project, but no official remediation or patch has been released as of the publication date.

Successful exploitation could allow an attacker with low privileges to read or access files outside the intended directory by manipulating the fileName parameter remotely. This could lead to unauthorized disclosure of sensitive information. There is no indication of privilege escalation, code execution, or denial of service from the provided data. No known exploits are reported in the wild.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's advisories for updates. Until a patch is released, consider restricting access to the affected endpoint and validating or sanitizing inputs to the fileName parameter as a temporary mitigation.