The vulnerability is an improper limitation of a pathname to a restricted directory, commonly referred to as path traversal or directory traversal. An attacker who can control the input filename can potentially read or write files outside the intended directory, leading to disclosure of sensitive data, modification of configuration files, or elevation of privileges with the process context. This weakness is identified as CWE‑22.

The affected product is Kobikom Telecommunications and Informatics Services Inc.'s Kobikom. The issue exists in all releases prior to the KobiPBX‑FOP3-SEC‑r1 update.

The CVSS score of 7.5 indicates a high severity, but the EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. Based on the description, it is inferred that the attack vector is through a web or network interface where file paths can be supplied by an unauthenticated or authenticated user. The primary impact is unauthorized file access, potentially compromising confidentiality and integrity of the system.