A path traversal flaw exists in the denied method of FileUploadProperties.java in hsweb-framework, allowing a crafted filename argument to reference files outside the intended upload directory. By supplying a filename that contains path traversal characters, an attacker can read arbitrary files on the server where the framework is running. This can expose sensitive configuration files, code, or other secrets. The vulnerability is triggered remotely via the web interface that accepts file uploads.

The flaw affects the hs-web hsweb-framework product, all releases up to and including 5.0.1. Organizations deploying these versions should verify the installed version and determine whether an update or patch can be applied.

CVSS score 5.3 indicates medium severity. No EPSS score is available, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers can exploit the flaw over the network by submitting a malicious file upload via the application’s web interface; the description explicitly states the attack is possible remotely. While the flaw does not grant arbitrary code execution, it allows unauthorized read of files, which can aid further attacks. Given the medium CVSS score and lack of mitigating controls mentioned, the risk is moderate but should prompt prompt remediation.