A path‑traversal flaw in the AMR Printer Management 1.01 Beta web service allows an unauthenticated remote attacker to read arbitrary files on the underlying Windows system. Because the service operates with elevated privileges and does not require authentication, the attacker can access sensitive system files, leading to disclosure of confidential internal information. The weakness corresponds to CWE‑22, where an attacker abuses inadequate path verification to reach files outside the intended directory.

The only affected product listed is the AMR Printer Management Beta web service, version 1.01, running on Windows. No other vendor or product details are provided. The CPE string indicates the specific service and version, confirming that this vulnerability is confined to the AMR 1.01 Beta release.

The CVSS base score of 8.7 rates the vulnerability as high severity, while the EPSS score of less than 1% indicates a low yet non‑zero probability of exploitation currently. The advisory notes that the vulnerability is not listed in the CISA KEV catalog. An attacker would simply send a crafted request containing a path traversal payload to the unprotected management endpoint, read any file path, and thereby compromise confidentiality. The lack of authentication and high privilege level increase the potential impact of a successful exploit.