The vulnerability is a path traversal flaw that lets an authenticated user supply any absolute filesystem path to the GET /public/get-file/{path} endpoint. Because the path parameter is passed directly to PHP’s file_get_contents() without any canonicalization or base directory restriction, attackers can read any file that the PHP‑FPM worker process can access. This results in a confidentiality breach and may expose application configuration, sensitive data, or credentials stored on the server.

The affected product is Volmarg Personal Management System. No specific version information is listed; the flaw exists in the current release of this product as published by the vendor.

The CVSS score of 7.1 indicates a moderate to high severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. The attack requires authentication to the system, but once authenticated, the attacker’s ability to read arbitrary files makes the impact potentially extensive, depending on the files accessible to the PHP process.