The vulnerability lies in the upload endpoint at /SubstationWEBV2/app/..;/main/upfile, where unsanitized path arguments can cause a directory traversal. An attacker can supply crafted values that resolve to files outside the intended upload directory, potentially exposing or modifying system files. The impact is limited to remote file system access; confidentiality and integrity of critical files could be compromised, but it does not directly allow arbitrary code execution. The flaw aligns with CWE‑22, which describes insufficient validation of file name arguments.

The affected product is Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform, specifically version 1.3.0. No other versions or vendors are listed, so the issue appears confined to this release.

The CVSS score of 6.9 reflects a moderate severity, and the EPSS score is not available at this time. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation campaigns have been recorded yet. However, the ability to manipulate a path remotely is a significant threat vector that could lead to unauthorized file access if exploited.