Description
Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
Affected products
gss: vitalsesp
References2
- www.twcert.org.tw/en/cp-139-10543-380bd-2.html Third Party Advisory
- www.twcert.org.tw/tw/cp-132-10542-4c682-1.html Third Party Advisory
Metrics
- CVSS 3.1
-
4.9
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 4.0
-
6.9
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 45 · as of 11 November 2026
- CWE
- CWE-36
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.