This vulnerability affects hs-web hsweb-framework versions 5.0.0 and 5.0.1. It arises from insufficient validation of the filename parameter in the File Upload component, enabling path traversal attacks via the 'denied' function in FileUploadProperties.java. An attacker can remotely exploit this to potentially access files outside the intended directory scope. The vulnerability has been publicly disclosed, and a patch commit has been identified but no official vendor advisory or remediation status is available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to perform path traversal by manipulating the filename argument in the file upload process. This could lead to unauthorized access to files on the server. The impact is rated medium with a CVSS score of 5.3, reflecting limited confidentiality, integrity, and availability impact. There are no known exploits in the wild at this time.

A patch identified by commit 8009845b577d8a2c4bbf4fdd8e8913799a714be6 is suggested to address this vulnerability. Since no official vendor advisory or remediation level is provided, it is recommended to apply this patch or update to a fixed version once available. Monitor the vendor's channels for an official fix or guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.