Technical impact
The vulnerability in Paisa versions prior to 0.7.8 originates from unchecked file name parameters in several API handlers—GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups. An attacker who can issue HTTP requests to these endpoints can inject sequences such as '../' into the file name field, causing the server to resolve the path outside the intended journal or sheets directories. This flaw permits reading of any file that the application’s runtime process can access, as well as removal of backup files located outside the expected directories. The result is a high‑impact, unauthenticated path traversal that compromises the confidentiality and integrity of the file system. The CVSS score of 8.8 reflects the severity of this impact.
Affected Systems
The issue directly affects the open‑source accounting application Paisa produced by the vendor ananthakumaran. All releases older than version 0.7.8 are vulnerable; subsequent releases contain the fix. No other vendors or product lines are listed in the advisory.
Risk and Exploitability
The CVSS baseline of 8.8 points to a high risk. The EPSS score of 2% indicates a low to moderate likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers require no authentication, merely the ability to reach the editor or delete_backups endpoints over HTTP. Because the application blindly accepts untrusted file names, the exploitation path—sending a crafted name containing '../' over the vulnerable API is straightforward and likely when the service is exposed to external networks. No additional conditions are needed for exploitation, and the vulnerability can be triggered from any network that can reach the affected endpoints.
