The vulnerability is a local file inclusion flaw in the admin/task.php run parameter. An authenticated administrator can supply arbitrary directory traversal sequences in the run argument, allowing the web application to include and disclose local files readable by the web server. This attack can expose configuration files, database credentials, or other sensitive data accessible to the server process.

Products affected are C97net qEngine CMS, Kemana Directory, and Cart Engine. Vulnerable versions are qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0. Any deployment using these or older releases is at risk.

The CVSS score of 7.1 indicates high severity. No EPSS score is available, so current exploit probability is unknown, but the flaw is not listed in CISA’s KEV catalog, suggesting no widely known exploitation at the time of assessment. Because the exploitation requires authenticated administrative access, the attack vector is limited to insiders or systems where the administrator credentials have been compromised. Once authenticated, the attacker can read any file that is readable by the web server, potentially leading to confidentiality compromise or further privilege escalation.