Dayforce ESS Excelity’s file download functionality suffers a path traversal flaw that can be exploited by unauthenticated users. By sending a GET request with a file path parameter set to any path, including an absolute local file path, an attacker can cause the server to return the contents of any file accessible to the application process, thus exposing sensitive data such as configuration files or credentials.

The vulnerability has been confirmed in Dayforce ESS Excelity, with the issue fixed in version V4. It may also impact other released versions that have not yet been evaluated. The issue resides specifically in the ESS Excelity product component as listed by the CNA.

With a CVSS base score of 9.2, the flaw is considered critical. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability, though the high severity rating still signals a critical risk. The vulnerability is not currently listed in CISA’s KEV catalog, implying that there is no confirmed public exploit yet, yet the attack vector is presumed to be remote and unauthenticated, making the risk substantial for any exposed systems.