This vulnerability (CWE-22) in Next4Biz CSM version 6.8.9 allows improper limitation of a pathname to a restricted directory, enabling path traversal attacks. This can lead to unauthorized access to files outside the intended directory scope. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. No official fix or remediation guidance has been provided by the vendor, and no known exploits are reported in the wild.

An attacker can exploit this vulnerability remotely without authentication or user interaction to read sensitive files outside the intended directory. This compromises confidentiality but does not affect integrity or availability. The impact is considered high due to potential exposure of sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should monitor official channels for updates and consider applying compensating controls such as restricting access to the affected service until a fix is released.