This vulnerability (CWE-22) in HAVELSAN Inc. Liman MYS involves improper limitation of a pathname to a restricted directory, enabling path traversal attacks. Versions >=2.3.2 and <2.3.4-1124 are affected. The flaw allows an attacker to read files outside the intended directory scope, potentially exposing sensitive information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and only confidentiality impact.

An attacker can exploit this vulnerability remotely without authentication to read files outside the restricted directory. This could lead to unauthorized disclosure of sensitive information. There is no impact on integrity or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor HAVELSAN Inc. advisories for updates. Until a fix is available, restrict network access to the affected service and apply any recommended configuration mitigations from the vendor.