INDOTALENT WHMS versions prior to 10.20261109 have a path traversal vulnerability that permits authenticated users to read arbitrary files. This occurs via the documentName and imageName parameters in the GetDocument and GetImage functions, which improperly use Path.Combine without containment checks. Attackers can exploit this by self-registering and supplying traversal sequences to access sensitive files such as appsettings.json.