The vulnerability resides in the addAccountHeadAndDetail function within the AccountHeadService component of jshERP 3.6 and earlier. An attacker can manipulate the fileName parameter to perform a path traversal attack, enabling the read of arbitrary files on the server. This flaw permits remote exploitation, potentially exposing sensitive configuration or source code, but it does not directly lead to remote code execution. The weakness is classified as CWE‑22, indicating a failure to limit the use of contextual information for file path construction.

The flaw affects all installations of jshERP up to version 3.6, distributed under the product jishenghua:jshERP. No specific sub‑versions beyond 3.6 are known to be vulnerable, and the vendor has not released a patch as of the time of this advisory.

The CVSS v3 score of 5.3 reflects a moderate severity, and the EPSS score is unavailable, suggesting limited public exploitation data. The vulnerability is not listed in the CISA KEV catalog. Because the attack can be performed remotely by sending crafted parameters to the addAccountHeadAndDetail endpoint, the risk is that attackers could harvest proprietary files or information from the server. The exploitation path requires only HTTP access to the vulnerable endpoint, making it broadly reachable if no mitigations are in place.