The vulnerability allows an attacker to overwrite critical internal files during the file import process. By replacing legitimate files, the attacker may achieve arbitrary code execution or expose sensitive information. The weakness arises from insufficient validation of file paths, permitting unintended file replacement.

UXGROUP LLC Voice Recorder version 10.0 is affected. No other versions or vendors are listed.

The impact can be severe, granting the ability to replace protected files. The likely attack vector is via the import feature, which may be exposed locally or remotely depending on the deployment environment. While CVSS and EPSS scores are not provided, the absence of mitigation from the vendor and the ease of triggering the flaw suggest a high potential for exploitation. The vulnerability is not listed in the CISA KEV catalog, but that does not reduce the risk in environments where the import function is available to untrusted users.