The vulnerability resides in the LayerImageController.Submit.cs endpoint of SSCMS 4.7.0. An attacker may manipulate the filePaths parameter to traverse directories, enabling reading of arbitrary files. This represents a path traversal (CWE‑22) that can expose confidential server data and potentially serve as a foothold for further attacks. The exploit is remote, relying only on HTTP requests to the public endpoint.

SSC Network Management System (SSCMS) version 4.7.0 is affected. No other versions are explicitly listed, so systems running this exact release should evaluate their exposure.

The CVSS score of 5.3 designates the problem as moderate severity. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw remotely by sending crafted requests to the layerImage endpoint; if successful, they can read files outside the intended directory. The risk is that sensitive configuration or credential files may be disclosed, and the exposed endpoint could be used for additional lateral movements.