PCViewer vt1000 is vulnerable to a directory traversal flaw that permits unauthenticated attackers to read arbitrary files on the host via malicious GET requests. By including relative path sequences such as ../../../../../../../../../../../../etc/passwd in a URL, a requester can manipulate the file system path used by the application and obtain sensitive files. This weakness is a classic example of CWE‑22, which enables attackers to bypass intended access controls and obtain confidential information.

The affected product is PCViewer from Softpedia. No version details were provided in the CVE data, so any release that has not applied the fix remains vulnerable.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is an unauthenticated HTTP GET request that supplies a path traversal sequence. An attacker can readily construct such requests without authentication, read arbitrary files such as /etc/passwd, and potentially glean other sensitive data. Because the application does not restrict the traversal sequences, the success of exploitation depends only on the presence of a vulnerable web service and writable host permissions to the PCViewer process.