This vulnerability in Qihui jtbc5 CMS 5.0.3.6 involves improper validation of a path argument in the Code Endpoint component's manage.php file, enabling remote attackers to perform path traversal attacks. This can allow attackers to access files and directories outside the intended scope. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Although an exploit has been published, the vendor has not provided any response or remediation guidance.

Successful exploitation of this vulnerability could allow an attacker with network access to the affected CMS to read arbitrary files on the server by traversing directories. This may lead to unauthorized disclosure of sensitive information. There is no indication of privilege escalation, denial of service, or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the affected component, applying network-level controls to limit exposure, and monitoring for exploitation attempts. Avoid using the affected version if possible until a patch is released.