A flaw in the Contact Plan, E‑Mail, SMS and Fax modules of Asseco SEE Live 2.0 permits authenticated users to retrieve arbitrary files from the host system. By manipulating the "path" parameter in the downloadAttachment and downloadAttachmentFromPath API calls, an attacker can read files that should not be exposed, potentially leaking sensitive data or application credentials. The underlying weakness involves improper input validation that allows a Local File Inclusion error and results in information disclosure.

The vulnerability affects the Asseco SEE Live 2.0 application, specifically its Contact Plan, E‑Mail, SMS and Fax components. Users running this product with the listed modules enabled are at risk. No additional version granularity is provided beyond the 2.0 release.

The CVSS base score of 6.5 indicates a moderate severity. The EPSS score of less than 1 % suggests that widespread exploitation is unlikely at present, and the vulnerability is not currently listed in CISA’s KEV catalog. Nonetheless, the flaw requires only an authenticated session to the API, making it potentially exploitable by legitimate users who gain access to the system. Attackers would exploit the API’s lack of strict path validation to read arbitrary files, thereby compromising confidentiality.