This vulnerability in SSCMS 4.7.0 arises from insufficient validation of the filePaths argument in an unspecified function of LayerImageController.Submit.cs, part of the layerImage endpoint. An attacker can manipulate this argument to perform path traversal, potentially accessing files outside the intended directory structure. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity.

Successful exploitation could allow an attacker to read or access files outside the intended directory boundaries on the SSCMS server. This could lead to unauthorized disclosure of sensitive information or system files. There is no indication of privilege escalation or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and monitor for suspicious activity related to file path manipulation. Avoid exposing the vulnerable SSCMS version to untrusted networks.