This path traversal vulnerability in Qsirch allows unauthenticated remote attackers to read arbitrary files or system data. The flaw arises when the application fails to correctly validate file paths, enabling traversal sequences that dereference outside expected directories. Successful exploitation could reveal sensitive configuration files, credentials, or system data, potentially leading to further compromise.

The affected product is QNAP Systems Inc.'s Qsirch. Exact vulnerable versions are not listed, but the vendor states that the issue is fixed in Qsirch 7.0.3.0 and later. All deployments of Qsirch prior to that version should be identified and considered at risk if the software allows unauthenticated access to its web interface or relevant endpoints.

The CVSS base score of 9.3 indicates a high severity vulnerability, though the EPSS score of <1% suggests a low probability of exploitation at present. The vulnerability is not yet listed in the CISA KEV catalog. The attack vector is remote, unauthenticated, and exploits path traversal; no special privileges are needed. Upgrading to the fixed version eliminates the risk.