This vulnerability involves improper handling of dot-dot-slash (../) sequences in the URI path component of HTTP requests in Quick.CMS. An authenticated attacker with administrative privileges can craft requests containing ../ sequences to access files located in directories adjacent to the webroot. The server fails to normalize these sequences before resolving file paths, enabling relative path traversal. The vendor has assessed the risk as low and decided that a patch is not required.

An attacker with admin privileges can read arbitrary files outside the webroot directory, potentially exposing sensitive information stored on the server. However, exploitation requires authenticated admin access, limiting the scope of impact. There are no known exploits in the wild.

The vendor has determined that a fix is not necessary due to the very low likelihood of exploitation. No official patch or remediation is currently available. Users should ensure that admin credentials are well protected to reduce risk.