A path traversal flaw exists in the getPicThumb function of the Items controller, where the pic_filename argument is improperly validated. An attacker can supply a crafted filename, causing the application to resolve directories outside its intended scope and potentially read any accessible file on the server. The issue is remotely exploitable and could disclose sensitive data, such as configuration files or stored credentials.

The vulnerability affects Open Source Point of Sale, versions up to 3.4.2 provided by opensourcepos. A fix was issued in commit def0c27a0e252668df8d942fc31e16d1edfd7323 and should be applied to upgrade to a patched release.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote and requires no authentication; once the attacker delivers a request with a crafted pic_filename, they can read arbitrary files within the server’s accessible filesystem. Compliance with the CWE-22 weakness suggests that once applied, the risk is mitigated but residual exposure exists if the application is accessible to untrusted users.