The vulnerability is a directory traversal flaw that allows a remote attacker to manipulate the UserName parameter and access arbitrary files on the server. If exploited, the attacker can read sensitive configuration files and execute arbitrary code remotely, compromising the confidentiality, integrity, and availability of the Easy Chat Server and potentially the underlying host system. The weakness is rooted in improper input validation, enabling traversal beyond the intended directory.

Easy Chat Server 3.1 is affected. No other vendors or product versions are listed.

The CVSS score is 6.5, but the absence of an EPSS value indicates limited publicly available exploitation data. Since the vulnerability allows remote code execution through a web-facing input, the potential for exploitation is high regardless of the EPSS metric. The vulnerability is not listed in the CISA KEV catalogue, which suggests it may not yet have widespread exploits, yet the impact remains severe if an attacker can target the affected instance.