Technical impact
The vulnerability permits an attacker to overwrite arbitrary internal files during the import process of the Ora Tools PDF Reader application. By exploiting this flaw, a malicious user can replace critical configuration or executable files, potentially leading to arbitrary code execution or unauthorized disclosure of sensitive information. This weakness corresponds to the CWE-73 class of relative path traversal or file overwrite vulnerabilities.
Affected Systems
Only the Ora Tools PDF Reader ' Reader & Editor APP version 4.3.5 is identified as vulnerable. No other versions or variants of the product are currently listed as affected, and no vendor product coverage is provided by the CNA.
Risk and Exploitability
With a CVSS base score of 8.4, the flaw is considered High severity. Exploit probability is not quantified by EPSS, and the vulnerability is not yet cataloged in the CISA Known Exploited Vulnerabilities list. The likely attack path requires that an attacker can trigger the file import routine, implying local or privileged access to the victim’s machine; however, the description does not detail further conditions, so the exact exploitation vector remains inferred.
