A flaw has been identified in the Qihui jtbc5 CMS that allows an attacker to manipulate the path argument in the /dev/code/common/diplomat/manage.php endpoint. This manipulation results in a path traversal condition, permitting the attacker to read files outside the intended directory or potentially overwrite files if write permissions exist. The vulnerability can be exploited remotely, and an exploitation technique has already been published.

The affected product is Qihui jtbc5 CMS, specifically version 5.0.3.6. The vulnerability resides in the Code Endpoint component located at /dev/code/common/diplomat/manage.php.

The CVSS score of 5.3 places the issue in the moderate severity range. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the fact that the attack is remote and that an exploit is publicly known indicates that there is a realistic risk of abuse. The path traversal can lead to unauthorized file disclosure or modification, potentially compromising system integrity and confidentiality.