Wertheim SafeController Software version 6.15.8328.28014 contains a path traversal flaw in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. The application concatenates the supplied value into a file path without proper validation, allowing an authenticated user to specify relative or absolute paths that escape the intended document directory. This permits download of any file readable by the web‑application process, including sensitive logs and executable binaries, thereby exposing confidential information and potentially enabling further attacks.

The vulnerable product is Wertheim SafeController Software used in Wertheim Vault Rooms for safe deposit lockers. Affected versions include AssemblyVersion 6.15.8328.28014; any deployment of this version without the vendor‑released patch is susceptible. The flaw exists specifically in the /safe/selfservice/openselfservicedocument endpoint exposed by the web interface of the SafeController application.

With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker needs valid authentication to reach the vulnerable endpoint. Based on the description, the most likely attack vector is an authenticated user within the system, such as a staff member or a compromised account, who can supply crafted documentName values to retrieve arbitrary files. Once the files are downloaded, the attacker could exfiltrate sensitive data or use binaries to expand their foothold.