The vulnerability is an unauthenticated path traversal flaw that permits a local attacker to read any file on the server’s operating system by manipulating HTTP request paths. This flaw falls under CWE‑22 and enables confidentiality compromise by exposing configuration files, credentials, or other sensitive data.

The issue affects the Neuron Soft Golem OEE MES application. All releases prior to version 11.6.0 are vulnerable; the fix was introduced in 11.6.0. Deployments running older versions without the update are exposed.

The CVSS score of 8.3 denotes high severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the flaw can be exploited by any host on the same local network that can send HTTP requests to the MES service. No authentication or privilege escalation is required, making the attack straightforward for an adversary with local network access.