ZwickRoell Test Data Management versions prior to 3.0.8 have a local file inclusion flaw in the /server/node_upgrade_srv.js endpoint. An unauthenticated attacker can supply directory traversal sequences via the firmware parameter to read arbitrary files from the server. This can reveal sensitive system files, exposing confidential information and potentially enabling further compromise. The vulnerability is identified as CWE-22 and scored with a CVSS score of 8.7, indicating high severity.

All installations of ZwickRoell GmbH & Co. KG Test Data Management running a version earlier than 3.0.8. No specific sub‑versions are listed beyond the <3.0.8 cutoff.

The CVSS score signals a high risk of exploitation. Although the EPSS score is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, the lack of authentication requirement and the ability to read arbitrary files make exploitation highly plausible for an attacker with network access to the server. The attack vector is likely remote or local within the network, and successful exploitation could lead to full information disclosure of critical system files.