The vulnerability is a directory traversal flaw in the api/update endpoint of NexoPOS v6.2.4. An attacker can supply crafted inputs that cause the application to resolve filesystem paths outside the intended directory. Insufficient sanitization may allow reading or otherwise accessing files on the host, which could include configuration files, credentials, or other sensitive data. Depending on the ability to write or execute through the endpoint, the attacker could also potentially modify files or gain execution privileges. The weakness aligns with CWE‑22.

This issue is specific to the NexoPOS point‑of‑sale software, version 6.2.4. All deployments running this exact release, and no other versions are expressly identified as affected. The vendor has not released an update or workaround in the provided data, so systems currently using this version remain vulnerable unless mitigated.

The current CVSS or EPSS metrics are not available, and the vulnerability is not listed in the CISA KEV catalog, leaving the severity unknown. However, directory traversal is a widely known and easily exploitable weakness. If the api/update endpoint is reachable from untrusted network locations, an attacker could exploit the flaw remotely by sending a crafted request. The absence of formal reporting or exploitation evidence does not eliminate the risk, but the lack of metrics means administrators should treat this as a potentially high‑risk issue until a fix is applied.