This vulnerability involves a path traversal flaw in Acrel Electrical's EEMS Enterprise Power Operation and Maintenance Cloud Platform version 1.3.0. Specifically, the flaw is in the processing of the file path argument in the endpoint /SubstationWEBV2/app/..;/main/upfile, which can be manipulated remotely to traverse directories and potentially access files outside the intended directory scope. The vulnerability requires no privileges or user interaction and has a medium impact on confidentiality, integrity, and availability. The vendor has not issued any patch or official fix, and the exploit has been publicly disclosed.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to read or access files outside the intended directory structure on the affected system. This may lead to unauthorized disclosure of sensitive information or other impacts depending on the files accessed. The CVSS 4.0 score of 6.9 reflects a medium severity with low to limited impact on confidentiality, integrity, and availability. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing compensating controls such as restricting network access to the affected endpoint, applying web application firewalls with path traversal detection, and monitoring for suspicious requests targeting the vulnerable path. Users should remain vigilant for any future vendor advisories or patches and apply them promptly once available.