A flaw in the DeleteFileServlet endpoint of rawchen sims allows a malicious actor to manipulate the "filename" parameter, leading to path traversal. This flaw can potentially allow access to files outside the intended directory, thereby compromising file confidentiality and integrity. The vulnerability is classified as a moderate‑severity condition, as reflected by its CVSS score of 5.3.

The affected product is rawchen:sims, specifically any deployment that includes the file sims-master/src/web/servlet/file/DeleteFileServlet.java and is based on the code commit 004f783b1db5ecdfad81c8fdc3b34171211112de. Versioning is not available, so any installation containing this code before a remediation commit remains susceptible.

The CVSS score of 5.3 indicates a moderate risk level, while the EPSS score of less than 1% suggests a relatively low exploitation probability according to current models. The CVE description notes that an exploit has been published, which indicates that the vulnerability can be used in practice. The attack can be launched remotely, as the flaw occurs within a publicly accessible web endpoint.