The Vulnerability occurs due to an absolute path traversal flaw within the Gotac Police Statistics Database System, allowing a remote, unauthenticated attacker to read any file on the underlying file system. This flaw represents a confidentiality breach, exposing sensitive system information and potentially proprietary or personal data. The weakness is classified as CWE‑36: Absolute Path Traversal.

The affected product is the Gotac Police Statistics Database System. All installations running any version prior to 1.0.3 are vulnerable. The vendor has released version 1.0.3 and later which contain the fix.

The CVSS score of 8.7 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a currently low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is the exposed web interface or API that allows an unauthenticated attacker to send a crafted request and trigger the traversal. An attacker would require only the ability to send such a request to the system, which is typically sufficient for remote exploitation on systems exposed to the Internet.