An unauthenticated remote attacker can send crafted XML-RPC requests to the XmlRpcServlet endpoint and cause the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp methods to read any file on the server. The vulnerability allows leakage of sensitive configuration data and database credentials, potentially compromising overall system confidentiality. The weakness is a path‑traversal style flaw captured by CWE‑22.

The affected product is Weaver Network Co., Ltd.’s E‑cology 9.5, for all releases prior to 10.52. The issue exists in the XML‑RPC interface of the platform and may impact any installation that has not been updated to the 10.52 release or later.

The flaw carries a CVSS score of 8.7, indicating high severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog, but the Shadowserver Foundation reported first exploitation on December 14, 2022. The likely attack vector is remote unauthenticated access to the XML-RPC service over the network. An attacker who succeeds can read arbitrary files, including configuration files and credentials, leading to data exposure and potential further compromise of the system.