ProcessMaker 3.5.4 contains a local file inclusion flaw that allows unauthenticated attackers to read arbitrary files on the host by sending HTTP requests with directory traversal sequences. The vulnerability is a CWE‑98 path traversal weakness. An attacker can access sensitive files such as /etc/passwd without authentication, leading to confidentiality compromise. No code execution is achieved.

ProcessMaker in version 3.5.4. No other versions are explicitly listed as affected.

The CVSS score of 6.9 indicates a medium severity vulnerability. The EPSS score is not available, and the flaw is not listed in CISA KEV, but the lack of authentication requirements and the ability to read system files raise a moderate risk. An attacker can trigger the flaw by crafting a URL with directory traversal characters, targeting the vulnerable endpoint, and obtaining file contents. Precautionary measures are required even though there is no known exploit in the wild.