A vulnerability exists in HerikLyma's CPPWebFramework up to version 3.1 that permits path traversal. By crafting a request that manipulates file paths, an attacker can read arbitrary files on the server. The vulnerability is remote, meaning it can be triggered over the network without local interaction, and is categorized as CWE-22, which indicates unsafe file path handling.

The affected product is HerikLyma CPPWebFramework. All releases up to the 3.1 series are impacted; any deployment using these versions is susceptible.

The severity score is medium (CVSS 6.9), with no publicly available EPSS data or KEV listing, but the exploit is publicly documented. Because it can be triggered via a normal HTTP request, an attacker with network access to the web application can exploit it. The lack of a released patch increases the risk; however, without code execution, the impact is limited to data disclosure rather than full system compromise.