An authenticated path traversal vulnerability in EvoMap Evolver prior to version 1.69.3 permits arbitrary file creation and system file overwriting, posing a high risk to operational integrity.

This flaw is a path traversal vulnerability categorized under CWE-22, caused by improper validation of the output path parameter during skill downloads. An authenticated attacker can manipulate the skill download command to write files to arbitrary locations on the filesystem.

The exploitation of this vulnerability can result in significant integrity and availability impacts by allowing malicious actors to overwrite critical system files or deposit unauthorized code into sensitive directories. This could lead to system downtime, unauthorized modifications, or complete system compromise. The assigned CVSS score of 8.1 reflects the severe potential impact on file integrity and system availability despite the requirement for low-level user authentication.

Immediate Action: Update the EvoMap Evolver package to version 1.69.3 or later across all affected environments.

Proactive Monitoring: Monitor access logs and command execution histories for anomalous skill download activities, specifically looking for unusual path parameters or attempts to write outside designated directories.

Compensating Controls: Restrict execution permissions for the self-evolving engine and implement strict file integrity monitoring to detect unauthorized modifications to critical system files.

Public Exploit Available: No

Given the high severity of this vulnerability and the potential for critical system file manipulation, administrators must apply the available patch to version 1.69.3 immediately. Prioritizing this update is essential to prevent unauthorized file writes and maintain the integrity of the underlying host environment.