The located vulnerability in the download.php file of the code-projects Online Lot Reservation System permits an attacker to supply a specially crafted File parameter that exploits a path traversal flaw. This flaw allows the reader to access files outside the intended download directory, and it could potentially expose sensitive system files and credentials, which is an inferred consequence rather than explicitly documented. The weakness is identified as CWE‑22 and results in the disclosure of arbitrary files rather than code execution or denial of service.

The flaw affects the code-projects Online Lot Reservation System, specifically versions up to and including 1.0. Users deploying these versions are at risk if the download.php endpoint is exposed to untrusted input.

With a CVSS score of 6.9, the vulnerability is classified as moderate severity. While EPSS data is not available, the issue has a publicly released exploit, indicating that the likelihood of an attack is non‑negligible. The exploit is remote and does not require privileged user access, making the risk higher for exposed installations. The vulnerability is not listed in CISA’s KEV catalog, but the existence of a public exploit suggests that attackers could target vulnerable systems before a vendor patch is applied.