A critical path traversal vulnerability in the geyang ml-logger library allows unauthenticated remote attackers to access unauthorized files, posing a significant risk to system integrity.

This is a path traversal vulnerability (CWE-22) residing in the log_handler function within ml_logger/server.py. An unauthenticated attacker can exploit this remotely by manipulating the File argument to access restricted files on the host system.

The ability to perform path traversal enables unauthorized file access, which can lead to the disclosure of sensitive configuration files, credentials, or source code. Given the CVSS score of 7.3, this high-severity flaw threatens the overall confidentiality and integrity of the affected application environment.

Immediate Action: As no specific patch version is currently defined due to the rolling release nature of the software, users should monitor the official GitHub repository for updates and restrict access to the ml-logger server interface.

Proactive Monitoring: Review application access logs for suspicious input patterns, specifically looking for directory traversal sequences like "../" within requests directed at the log_handler endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block requests containing path traversal sequences directed toward the vulnerable service.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced by the vendor.

The presence of a public proof-of-concept coupled with the ease of exploitation makes this vulnerability a priority for remediation. Security teams should identify all instances of the ml-logger library in use and apply the latest available updates from the upstream repository as soon as they are published to neutralize the path traversal vector.