An unauthenticated path traversal vulnerability in AndSoft e-TMS version 25.03 presents a significant risk of unauthorized file access.

This is a path traversal vulnerability (CWE-22) affecting the docurl parameter in the /lib/asp/DOCSAVEASASP.ASP endpoint. The vulnerability is exploitable by unauthenticated remote attackers, as indicated by the CVSS vector PR:N.

Successful exploitation allows unauthorized access to sensitive files residing within the web root directory. Given the CVSS score of 7.5, this vulnerability is classified as High severity, potentially leading to the exposure of configuration files, source code, or internal data that could facilitate further system compromise or data breaches.

Immediate Action: Update the affected e-TMS installation to patch versions VNL 25001 or VNL 25010 as provided by the vendor.

Proactive Monitoring: Review web access logs for anomalous requests targeting /lib/asp/DOCSAVEASASP.ASP, particularly those containing directory traversal sequences such as dot-dot-slash patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing directory traversal sequences in the docurl parameter.

Public Exploit Available: No (exploit_available: false).

The severity of this vulnerability, combined with the ease of exploitation, necessitates immediate attention. Organizations running AndSoft e-TMS v25.03 must prioritize the application of the vendor-provided patches. If patching is not immediately feasible, ensure robust WAF filtering is in place to restrict access to the vulnerable endpoint.