The vulnerability is a classic directory traversal flaw that allows an attacker with super user privileges to craft a file path that bypasses normal access controls. By supplying such a path to the application, the attacker can read any file that the local file system permits the process to read, or potentially force the service to perform an authentication operation. This leads to exposure of sensitive configuration data, credentials, or other confidential information, compromising confidentiality and potentially integrity if the attacker can influence authentication logic.

KOVAI Biztalk360 installations running versions up to and including 11.5 are affected.

The CVSS score of 6.8 indicates moderate severity. Exploit probability, according to EPSS, is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Successful exploitation requires the attacker to already possess super user access or to elevate privileges to that level; therefore the risk is primarily for systems with compromised or privileged users. If such access exists, the attacker can easily supply a malicious path to read arbitrary files, making the threat significant but the likelihood of a fresh attack low unless privileged credentials are exposed.