HerikLyma CPPWebFramework versions 3.0 and 3.1 contain a path traversal vulnerability that can be exploited remotely without authentication or user interaction. The vulnerability allows attackers to manipulate certain inputs to traverse directories and potentially access unauthorized files. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality. The vendor has been informed but has not issued a response or patch. No cloud service is involved, and no known exploits in the wild have been confirmed.

Successful exploitation of this vulnerability could allow an attacker to read files outside the intended directory scope on the server running the vulnerable framework. This could lead to unauthorized disclosure of sensitive information. The CVSS score of 6.9 (medium severity) reflects a moderate risk due to the ease of remote exploitation and potential information exposure. No direct evidence of active exploitation in the wild is reported.

No official patch or remediation is currently available from the vendor. Users of HerikLyma CPPWebFramework up to version 3.1 should monitor the vendor's communications for updates. Until a fix is released, consider implementing network-level controls to restrict access to the vulnerable service and review application configurations to limit file system exposure where possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.