A path‑traversal flaw exists in Oinone Pamirs’ RestController LocalFileClient.java, where the request.getParameter method for the uniqueFileName argument is vulnerable. This weakness, identified as CWE‑22, allows an attacker to craft a filename that can reference files outside the intended directory, potentially exposing sensitive data on the system. The high level of risk lies primarily in the potential to read arbitrary files, though the overall CVSS score of 2.4 indicates a low severity effect under current conditions.

The vulnerability affects Oinone Pamirs versions up to and including 7.2.0. No specific sub‑versions are listed, but any installation of Oinone Pamirs within that range could be impacted.

The exploit is local, with the attackable interface available on the device, meaning the attacker would need local or network access to the application to influence the uniqueFileName parameter. The EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, reducing the immediacy of widespread exploitation. The CVSS score of 2.4 reflects a low impact but should not be ignored due to the possibility of data disclosure in trusted environments.