This vulnerability (CWE-22) in eBA Plus Document and Workflow Management System allows improper limitation of a pathname to a restricted directory, enabling path traversal attacks. Versions >=6.7.141 and <10.0.11 are affected. The flaw permits an attacker with network access and low privileges to read sensitive files outside the intended directory scope, impacting confidentiality without affecting integrity or availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An attacker with low privileges can exploit this vulnerability remotely to access sensitive files outside the intended directory, leading to a high confidentiality impact. There is no impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, monitor the vendor's communications for updates. Until a fix is available, restrict network access to the affected versions and limit user privileges to reduce exposure.