This vulnerability affects the sonic-server product from SonicCloudOrg, specifically in the file upload endpoint implemented in FileTool.java. By manipulating the 'Type' parameter in the Upload function, an attacker can perform path traversal, potentially accessing or overwriting files outside the intended directory. The vulnerability is remotely exploitable without requiring user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. No patch or official remediation has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to access or modify files outside the designated upload directory on the affected server. This may lead to unauthorized disclosure or alteration of sensitive files, potentially compromising the integrity and confidentiality of the system. However, the overall impact is rated medium, reflecting limited scope or complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as restricting access to the upload endpoint, validating and sanitizing input parameters, or deploying web application firewalls to detect and block path traversal attempts.