This vulnerability, identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), exists in AKINSOFT Wolvox9 ERP / KontrolPanel.exe. It allows an attacker to perform path traversal, potentially accessing files outside the designated restricted directories. The affected versions range from s26.02.17 before 26.02.22. The CVSS 3.1 score of 7.5 indicates a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No patch or official remediation level has been published yet.

An attacker can exploit this vulnerability remotely without authentication or user interaction to read sensitive files outside the intended directory. This can lead to disclosure of confidential information. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected service and monitor for suspicious activity related to path traversal attempts.