The flaw exposes a path traversal vulnerability in RTGS2017 NagaAgent’s Skills Endpoint, specifically in the extensions.py file. User-controlled input passed through the Name argument is not validated, allowing an attacker to reference files outside the intended directory. This can lead to reading arbitrary files and, depending on file permissions, executing code, raising confidentiality and integrity risks. The weakness is classified as CWE‑22.

All installations of RTGS2017 NagaAgent through version 5.1.0 are affected, as the vulnerability is present in the Skills Endpoint component of the APIServer. No later versions are known to be patched in the provided data.

The CVSS score of 6.9 places the issue in the moderate category, and although an EPSS score is not available, the advisory states that the attack is possible remotely. The vulnerability is not listed in CISA’s KEV catalog and no public exploit has been reported, but the path traversal could be leveraged by a malicious actor to exfiltrate data or elevate privileges if the server process has sufficient filesystem access. The overall risk warrants prompt remediation.