A path traversal flaw in the /webapi/file/transfer endpoint allows an authenticated attacker to download arbitrary files by supplying a type of db_backup and a name parameter containing ../ sequences. The vulnerability lets the attacker read sensitive files such as /etc/passwd and other system data, effectively exposing confidential system information. Authentication is trivial because a hard‑coded systemi account exists, making the attack straightforward once the target is exposed.

The flaw affects Penta Security Systems WAPPLES versions 4.0.54.1, 5.0, and 6.0. These specific releases are listed in the advisory and are known to be vulnerable.

The CVSS score of 7.1 indicates a moderate‑to‑high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited widespread exploitation currently. Nevertheless, because authentication is effectively bypassed, an attacker with network access can easily trigger the flaw by issuing a simple GET request, making the risk significant for compromised or insider threats.