A path traversal flaw exists in the updateDb function of sar2html’s File Upload component. By manipulating the file path that the function processes, an attacker can read or overwrite arbitrary files on the host, which can lead to remote code execution or other malicious actions. The flaw is identified as CWE‑22 and allows exploitation without requiring local privileges.

The vulnerability affects the open‑source tool cemtan sar2html version 4.0.0. No other versions are listed as impacted in the CNA data.

The CVSS base score of 6.9 indicates medium severity. EPSS data is not available, and the vulnerability is not in CISA’s KEV catalog. Remote exploitation is possible through the File Upload interface, meaning an attacker with network access to the application can trigger the path traversal. Successful exploitation could compromise confidentiality, integrity, or availability of the underlying system.