A path traversal flaw in the page argument of index.php permits an attacker to craft a value that includes malicious files, leading to remote file inclusion. The flaw is a name‑based input validation weakness identified as CWE-73. If exploited, the attacker could read sensitive files, inject arbitrary code, or otherwise tamper with the application’s file system, compromising confidentiality, integrity, and potentially availability of the web service.

The vulnerability affects the open‑source oretnom23 file-management-system-php, but no specific release identifiers are provided because the project follows a rolling release model. All releases prior to an undisclosed patched revision are potentially affected.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, suggesting limited exploitation data. The vulnerability is not listed in the CISA KEV catalog, but it has been publicly disclosed and can be triggered remotely. Given the lack of a patch and the ease of exploitation via a simple URL parameter, the risk to systems that expose the vulnerable page remains moderate to high, especially in environments lacking additional input filtering or access controls.