VertiGIS FM contains a local file inclusion flaw in its upload/download flow that allows authenticated users to manipulate a file's path to read any file stored on the server. Exploiting this, an attacker can obtain sensitive configuration files such as web.config, which could enable remote code execution on the underlying ASP.NET host. The vulnerability also permits the resolution of UNC paths, opening the possibility of NTLM‑relaying attacks if SMB traffic is exposed.

The issue is verified against VertiGIS FM version 10.5.00119 (build 0d29d428). All installations running this version or earlier that have not applied the vendor’s fix are considered vulnerable.

The flaw scores a CVSS of 7.4, indicating a high severity. The EPSS score is below 1%, suggesting that widespread exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. Because the attack requires authenticated access to the web application, the vector is the application itself; however, successful exploitation could lead to file disclosure, remote code execution, and possible lateral movement via NTLM relaying. Monitoring for unusual file upload activity and the presence of sensitive files in the webroot is recommended.