The vulnerability arises from the concatenation of the $uri and $args variables in the Nginx configuration file of Open Security Issue Management (OSIM). This concatenation allows an attacker to craft query parameters that traverse directory boundaries, leading to a directory traversal flaw (CWE-22). The flaw can enable access to arbitrary files on the filesystem, potentially exposing sensitive data or configuration files.

Red Hat Open Security Issue Management (OSIM) versions earlier than 2025.9.0 are affected. Users of these releases should verify their installed version against the stated cutoff.

The CVSS score of 7.5 indicates high severity, yet the EPSS score is reported as less than 1%, suggesting a low probability of exploitation in the short term. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, involving HTTP requests that supply crafted query parameters to the Nginx server. Successful exploitation would require the attacker to reach the OSIM instance and supply the malicious parameters, after which the server may serve files outside the intended directory scope.