The vulnerability in MRCMS 3.1.2 allows remote attackers to enumerate the contents of server directories through the /admin/file/list.do endpoint. Because the endpoint lacks authentication controls and proper input validation, any user can retrieve listings of files stored on the server. This defect represents an input validation flaw (CWE‑20) and an unauthenticated access weakness (CWE‑425). An attacker who invokes the endpoint can gain visibility into file names and directory structure, potentially revealing sensitive configuration files or user data, thereby compromising confidentiality and providing information that could aid further attacks.

The affected product is the MRCMS content management system, version 3.1.2. No other vendors or product variants are listed as affected in the available data.

The CVSS score of 5.3 indicates moderate risk. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote and unauthenticated; an attacker merely needs to send an HTTP request to the vulnerable endpoint to enumerate directory listings. Because no authentication is required, any web‐accessible client can exploit the flaw, but the lack of persistence or destructive impact limits the severity to information disclosure rather than code execution or denial of service.