Bimser Solution Software's eBA Plus Document and Workflow Management System contains a path traversal vulnerability that allows an attacker to craft a request with a malicious pathname. The flaw leads to the system resolving the filename outside its intended document directory, which can expose arbitrary files stored on the underlying file system. While the advisory does not indicate further exploitation, the ability to read files is a significant confidentiality risk.

The affected product is Bimser Solution Software Trade Inc. eBA Plus Document and Workflow Management System. Vulnerabilities exist in all releases from 6.7.141 up through 10.0.10; versions 10.0.11 and later are not impacted.

The CVSS score of 6.5 reflects a medium severity that assumes authenticated or local access to the application. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits at the time of this analysis. Attackers would need to reach the vulnerable functionality, which may be exposed over the network or accessible to privileged users, to abuse the path traversal. Because the flaw enables reading arbitrary files, it could be used to obtain sensitive configuration or authentication credentials if such files reside within the system's files.