This vulnerability arises from incorrect access control on the file_details.asp endpoint of Acora CMS. An attacker who has been granted editor privileges can construct special requests that cause the server to return any file located on its filesystem. The result is that confidential or sensitive content can be read by the attacker, representing an information‑disclosure issue classified as CWE-284.

The affected product is DDSN Interactive Acora CMS version 10.7.1. No other vendor or product variants are listed in the CVE record.

The CVSS score of 6.5 indicates a moderate severity level, while the EPSS score is not available and the vulnerability is not cataloged on CISA’s KEV list. Attackers only need to possess editor access, a role that is often delegated to non‑administrative users. The exploit requires only a crafted HTTP request and can be performed remotely. The lack of a higher level of authentication or additional verification makes exploitation straightforward once editor access is achieved.