A flaw exists in the createFileBypath function of Doramart DoraCMS 3.0.x. The function accepts a file path from a HTTP request and writes a new file at that location. Manipulating the path can lead to traversal beyond the intended directory, allowing the creation or overwriting of files outside the web root. The vulnerability can be triggered remotely by sending a crafted request to the exposed API endpoint.

The issue affects Doramart’s DoraCMS version 3.0.x. No other versions or variants are mentioned in the advisory.

The CVSS score of 5.3 denotes medium severity. The EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in CISA's KEV catalog. The exploit has been publicly released, and the description specifically states that the attack can be initiated remotely; however, no authentication or privilege requirements are described in the CVE data.