INDOTALENT WHMS contains a path traversal flaw that lets an authenticated user supply a file name parameter with traversal sequences. The application uses Path.Combine without containment checks, allowing reads of arbitrary files such as appsettings.json. The weakness is a classic relative path traversal (CWE‑22), which can expose sensitive configuration and potentially other system files to the attacker.

This vulnerability affects versions of go2ismail's Asp.Net-Core-Inventory-Order-Management-System released before v10.20261109. The product is distributed under the name Asp.Net-Core-Inventory-Order-Management-System by go2ismail.

The CVSS score is 7.1, indicating a high severity level. EPSS data is not available, so the precise probability of exploitation is unknown, but the flaw requires only a legitimate user account, which can be obtained by self‑registration. The vulnerability is not currently listed in the CISA KEV catalog, but the attack path is straightforward: supply a traversal sequence to GetDocument or GetImage and read the target file. Organizations running vulnerable versions should consider the risk of information disclosure when deciding on remediation.