Softneta MedDream PACS Server Premium 6.7.1.1 contains a directory traversal flaw in the nocache.php script that allows an attacker to manipulate the path parameter and read files outside the intended directory, including system configuration and password files. The vulnerability is exploitable without authentication and is classified as CWE-22, enabling an attacker to compromise confidentiality of sensitive data by retrieving arbitrary files from the host.

The vulnerability affects Softneta MedDream PACS Server Premium version 6.7.1.1. No other product or version information is listed as impacted, indicating that this specific build is the only known affected edition.

With a CVSS score of 8.7, this flaw is considered high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Because the attack requires only a crafted HTTP request to nocache.php and no authentication, the likelihood of exploitation is significant in environments where the software is exposed to untrusted networks. Successful exploitation would give an attacker read access to sensitive configuration and user credential files, potentially facilitating further attacks on the system.