The vulnerability resides in the file_exists function within the Uploadify module’s check‑exists.php script. An attacker can supply a crafted filename argument that causes the server to reveal whether a file or directory exists. This disclosure can expose internal directory structures and potentially sensitive files.

The flaw affects the light0011 CMS, specifically the Uploadify component that includes the check‑exists.php endpoint. No particular CMS version numbers are enumerated, but any installation that exposes the vulnerable endpoint is susceptible.

The CVSS score of 6.9 indicates moderate severity, and a very low exploitation probability is reflected by an EPSS score of < 1%. The vulnerability is not listed in CISA KEV. Because the exploit is publicly available, it can be triggered remotely through a crafted HTTP request. The publicly available exploit increases the risk for exposed deployments.