This vulnerability exists in rawchen sims up to commit 004f783b1db5ecdfad81c8fdc3b34171211112de, specifically in the DeleteFileServlet.java component. By manipulating the filename parameter, an attacker can perform a path traversal attack, potentially accessing or deleting files outside the intended directory. The attack can be launched remotely without user interaction and requires low privileges. The vendor has not provided any patch or mitigation guidance, and the product does not use versioning, complicating identification of affected releases.

Successful exploitation can lead to unauthorized file system access or deletion via path traversal, which may compromise data integrity or availability. The CVSS score of 5.3 indicates a medium impact, reflecting the potential for limited privilege escalation and remote exploitation without user interaction. There are no confirmed active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing access controls or input validation on the filename parameter as a temporary mitigation. Monitoring for suspicious requests targeting the deleteFileServlet endpoint is advisable until an official patch is released.