This vulnerability, classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), exists in HUMANIST Digital Human Resources version 26.0. It allows an attacker with network access and low privileges to perform a path traversal attack, potentially reading sensitive files outside the restricted directory. The CVSS v3.1 base score is 6.5, reflecting a medium severity with high confidentiality impact but no integrity or availability impact. The vulnerability is publicly disclosed but lacks an official fix or patch as of the publication date.

An attacker with low privileges can exploit this vulnerability remotely to read sensitive files outside the intended directory structure, potentially exposing confidential information. There is no impact on integrity or availability reported. No active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected version 26.0 of HUMANIST Digital Human Resources and monitor for unusual file access patterns. Avoid exposing the vulnerable service to untrusted networks.