EAP Legislator allows an attacker to craft a malicious zipx archive that, when opened by a victim, extracts files to any location outside the intended directory, such as system startup folders. This Path Traversal flaw enables the attacker to write files arbitrarily on the system, a vulnerability mapped to CWE-22, and is rated with a CVSS score of 8.6, indicating high severity.

The affected system is the EAP Legislator application from ABC PRO SP. Z O.O. Versions prior to 2.25a are vulnerable, while 2.25a and later contain the fix.

The exploit requires the victim to open a specially crafted zipx file; the attack vector is likely opportunistic delivery such as email attachment or filesystem upload. Ephemeral EPSS score is below 1%, suggesting currently low likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Nonetheless, the high CVSS score and file write capability leave the asset exposed if an attacker can deliver the archive.