A directory traversal vulnerability in OpenSatKit 2.2.1 enables unauthenticated attackers to access or delete arbitrary files, posing a significant risk to system integrity and data confidentiality.

This is a directory traversal flaw occurring within the FileUtil_GetFileInfo function, which fails to properly sanitize input. An unauthenticated attacker can supply a crafted value to this function to escape the intended directory structure and manipulate files on the underlying filesystem.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive system files or the destruction of critical application data. Given the CVSS score of 7.5, this is classified as a High severity issue, as it allows remote, unauthenticated access to system resources that could result in total service disruption or information leakage.

Immediate Action: Update to the latest version of OpenSatKit that incorporates the fix provided in commit 0c8d552dd0585a00593c08717845267d979a4951.

Proactive Monitoring: Review application and system access logs for suspicious path traversal patterns, such as sequences containing dot-dot-slash (../) characters directed at the file management modules.

Compensating Controls: Implement strict input validation at the Web Application Firewall layer to filter and block requests containing directory traversal sequences directed at the application.

Public Exploit Available: No

The high severity of this vulnerability, combined with the lack of required authentication for exploitation, necessitates immediate attention. Administrators should verify their current deployment version and apply the vendor-provided patch as soon as possible to prevent potential unauthorized file access or data loss.