The Open ISES Project 3.30A is vulnerable to a path traversal flaw in the ajax/download.php endpoint that lets anyone craft a filename parameter containing sequences such as "../" to reference files outside the intended directory. This vulnerability enables an unauthenticated attacker to download any file the web server can read, including configuration files and system files, thereby exposing sensitive data stored on the server.

The flaw affects the Open ISES Project 3.30A as distributed by Openises. No additional product variants or version ranges are listed in the CVE data, and the vulnerability is attributed solely to this specific release.

The CVSS score of 8.7 indicates a high severity issue that can be exploited without authentication by submitting a manipulated URL to ajax/download.php. The EPSS score is not available, and the vulnerability is not present in the CISA KEV catalog. Attackers would need network access to the web application and can perform the exploit purely by sending a crafted HTTP request, making the risk real for exposed deployments.