YouDataSum CPAS Audit Management System V4 has a path traversal flaw that allows unauthenticated users to read arbitrary files on the server. By sending specially crafted GET requests to the /cpasm4/plugInManController/downPlugs endpoint and inserting "../" sequences into the fileId parameter, an attacker can access sensitive files such as /etc/passwd and potentially other configuration or application files. This flaw directly compromises the confidentiality of server data and could lead to additional exploitation if further privileged files become exposed.

The vulnerability affects the YouDataSum CPAS Audit Management System, specifically version 4. No patch or version information is provided in the CNA data, indicating that this release may still be vulnerable wherever it is deployed.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, so the current likelihood of exploitation cannot be precisely assessed, but remote unauthenticated access makes it attractive to attackers. The flaw is not listed in the CISA KEV catalog, suggesting no widely known active exploitation. Based on the description, the attack vector is external via HTTP requests, and the vulnerability can be leveraged remotely with no authentication requirement.