VideoFlow Digital Video Protection DVP 2.10 has an authenticated directory traversal flaw that lets authenticated users supply path traversal sequences in the ID parameter to download scripts such as downloadsys.pl, download_xml.pl, download.pl, downloadmib.pl, and downloadFile.pl. This enables the attacker to read arbitrary files on the server, including sensitive files like /etc/passwd, leading to confidential data compromise. The weakness is identified as CWE‑22.

The affected product is VideoFlow Digital Video Protection DVP 2.10 from VideoFlow Ltd. No other versions are explicitly listed as vulnerable.

The CVSS score of 7.1 indicates a high severity vulnerability that requires authentication on the target system. EPSS data is not available, so the probability of exploitation cannot be quantified, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is via an authenticated user submitting crafted download requests; the attacker needs valid credentials and can then acquire arbitrary files which may contain credentials or system configuration data.