SourceCodester Best Employee Management System 1.0 contains a flaw that allows an unauthenticated remote attacker to trigger a directory listing of the /assets/uploadImage/Profile/ directory. The directory listing exposes files that may hold sensitive employee information or configuration data. This vulnerability is classified as CWE‑548 (Exposed Sensitive Information) and CWE‑552 (Sensitive File or Directory Discovery), indicating that sensitive data is inadvertently revealed due to insufficient access controls. Based on the description, the attack can be performed by sending an unauthenticated HTTP request to the /assets/uploadImage/Profile/ path, which triggers the directory listing.

The affected product is SourceCodester Best Employee Management System version 1.0. The flaw resides in an internal function that manages the /assets/uploadImage/Profile/ directory. No other vendor or product variants are identified in the advisory. The vulnerability may impact any deployment that uses this directory structure and allows public access to that location.

The vulnerability has a CVSS score of 6.9, which signifies a moderate level of risk. Its EPSS score is not available and it is not listed in CISA’s KEV catalog, indicating no confirmed exploitation yet. The flaw can be exploited remotely by a simple unauthenticated HTTP request, and it does not require any special credentials or elevated privileges. Because the attacker only needs to access a publicly exposed URL, the likelihood of discovery and exploitation remains significant as long as the directory listing remains enabled. The absence of a patch at the time of analysis underscores the need for prompt remediation.