The vulnerability resides in the UploadImage.do endpoint of Fujian Apex LiveBOS. An attacker can supply a crafted filename parameter that causes the application to resolve paths outside the intended directory, enabling access to arbitrary files on the server. Because the vulnerability is reachable over the network, the attacker can exploit it remotely and read or potentially execute sensitive files, which may lead to further compromise.

The affected product is Fujian Apex LiveBOS versions up to 2.0. The recommended fix is to upgrade the component to version 2.1 or later, which closes the path traversal flaw. Administrators should verify whether any lower versions are in use and plan an upgrade accordingly.

The CVSS score of 6.9 indicates a moderate severity. No EPSS data is available, and the issue is not listed in CISA's KEV catalog. Nonetheless, the presence of a publicly disclosed exploit and remote reachability make it a realistic threat to systems exposed to the internet.