This vulnerability exists in the deleteFileServlet endpoint of rawchen sims, specifically in the file DeleteFileServlet.java. By manipulating the filename parameter, an attacker can perform a path traversal attack, potentially accessing or deleting files outside the intended directory. The vulnerability is remotely exploitable without user interaction and requires low attack complexity with low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor has not issued any patch or advisory, and the product does not use versioning, complicating identification of affected releases.

Successful exploitation could allow an attacker to delete or access files outside the intended directory structure on the affected system, potentially leading to unauthorized file manipulation. The impact is limited by the need for some level of privileges (PR:L) and the vulnerability's low integrity and availability impact. No confirmed exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor. Users should monitor vendor communications for updates. Until a patch is released, consider restricting access to the vulnerable endpoint, implementing input validation or filtering on the filename parameter, and applying compensating controls to limit the impact of potential path traversal attempts.