NexoPOS version 6.2.4 contains a critical directory traversal vulnerability in its api/update endpoint. This flaw allows an attacker to access files and directories outside the intended scope, potentially leading to full system compromise. The vulnerability has a CVSS score of 9.8, indicating high severity with impacts on confidentiality, integrity, and availability.