The vulnerability is a path traversal flaw that allows attackers to delete arbitrary files. An attacker can supply specially crafted inputs that bypass path restrictions, resulting in file deletion and compromising system integrity and data availability.

Products from DOS Co., Ltd., namely SS1 and SS1 Cloud, and the ODM product rocoeyes from Rococo Co. Ltd., are affected. No specific version information is provided, so all current releases of these products may be vulnerable until patched.

The CVSS score of 6.9 indicates moderate severity. EPSS score is not available, so exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by sending crafted requests to the vulnerable applications, assuming they have network access to the target system. Because file deletion impacts system integrity and data availability, organizations should treat this as a potential data loss risk.