The IAS Canias ERP 8.03 system has a path traversal flaw in its RMI interface function iasRequestFileEvent. By altering the m_strSourceFileName argument, an attacker can cause the server to resolve directories outside the intended file boundary and read arbitrary files on the underlying filesystem. Remote exploitation is possible because the vulnerable function is exposed through RMI and can be hit from outside the host without prior authentication, according to the description.

Industrial Application Software IAS Canias ERP version 8.03 is the only product and version explicitly listed as affected. No other releases or related components are mentioned.

The CVSS score of 6.9 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited observed exploitation. However, because the flaw can be triggered remotely and the exploit has been publicly disclosed, administrators should treat it as a realistic threat until mitigation steps are applied.