Technical impact
The flaw is a directory traversal vulnerability in the api/update endpoint of NexoPOS v6.2.4. It allows remote actors to craft input paths that resolve to filesystem locations outside the intended directory. This can expose configuration files, credentials, or other sensitive data, and could potentially allow modification or execution of files if write or execute permissions exist. The vulnerability is a path traversal flaw, permitting unauthorized file access.
Affected Systems
This vulnerability affects only NexoPOS v6.2.4. No other major version is listed, and the vendor has not released a patch or workaround in the provided data. All installations running that exact version and exposing the api/update endpoint remain vulnerable.
Risk and Exploitability
The CVSS score of 9.8 indicates critical severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited remotely if the api/update endpoint is reachable from an untrusted network. Based on the description, the likely attack vector is a remote HTTP request that supplies a crafted path; exploitation could achieve unauthorized file disclosure or even modification if the process has sufficient permissions.
