The vulnerability is an improper limitation of a pathname to a restricted directory, allowing an attacker to traverse directories and read files outside the intended range. The weakness is identified as CWE-22 Path Traversal. This can allow an attacker to read arbitrary files accessible to the system process.

Innotim Software, Telecommunications, and Consulting Co. Ltd.’s Logsign SIEM. Affected versions are 6.4.120 and 6.4.121; versions newer than 6.4.122 are not affected. The vulnerability applies to the Logsign SIEM product as indicated.

The CVSS score of 6.5 indicates a moderate severity. EPSS is not available, so there is no current evidence of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability allows an attacker to read arbitrary files from the server's filesystem due to improper limitation of a pathname to a restricted directory. Exact attack conditions are not specified in the CVE data, so the risk depends on the application's ability to accept potentially malicious file path inputs.