phpTransformer 2016.9 contains a directory traversal flaw in the jQueryFileUpload master endpoint. An unauthenticated attacker can manipulate the path parameter with traversal sequences such as ../../../../../../ to list and download files located outside the intended upload directory. This allows reading of any file that the web server process can access, thereby compromising confidentiality and potentially enabling further exploitation. The weakness is classified as CWE‑22 and the CVSS score of 8.7 indicates high severity.

The affected product is phpTransformer version 2016.9 from codnloc, as identified by the provided CPE string. No other versions are noted as vulnerable. Applying an upgrade to a release that removes this flaw mitigates the risk.

The EPSS score of 2 % suggests a relatively low probability of opportunistic exploitation at present, and the flaw is not listed in CISA KEV. Nevertheless, the vulnerability can be exploited trivially over HTTP without authentication, so any instance of the vulnerable endpoint that is reachable from an attacker can be used to read arbitrary files. The high CVSS rating and the existence of publicly available exploit code indicate that active exploitation could occur if the endpoint is exposed externally. Organizations should assess the exposure of the jQueryFileUpload master endpoint before prioritizing remediation.