Weaver E‑cology 8.0 contains an unauthenticated path traversal flaw in the /weaver/ln.FileDownload endpoint that allows attackers to read arbitrary files on the server by supplying specially crafted values in the fpath parameter. The vulnerability enables disclosure of sensitive configuration and application files, such as WEB‑INF/web.xml, and can be used to harvest credentials or other confidential data. The weakness is a classic directory traversal error, identified as CWE-22, and can compromise confidentiality of any file that the web application process can read.

The affected system is Weaver Network Co., Ltd.’s E‑cology software version 8.0.

The vulnerability is scored high with a CVSS base of 8.7, indicating serious potential impact. The EPSS score is not available, so the current global likelihood of exploitation is unknown, but the flaw is unauthenticated and can be triggered by simple HTTP GET requests. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is currently documented beyond proof‑of‑concept evidence. Attackers can reach the endpoint over the network, making it vulnerable from any external or internal host with network access to the web service.