A critical directory traversal vulnerability in Menyoo 2.0 allows local attackers to achieve arbitrary code execution.

This is a directory traversal vulnerability that stems from inadequate input validation and path sanitization within the Spooner, VehicleSpawner, and WeaponOptions file management functionalities. It requires a local attacker to interact with these specific components to trigger the flaw and execute arbitrary code.

Successful exploitation of this vulnerability permits a local user to execute arbitrary code on the host system. Given the CVSS score of 7.8, the potential for full system compromise is significant, potentially leading to unauthorized data access, lateral movement, or complete loss of system integrity.

Immediate Action: Upgrade to the latest version of Menyoo or apply the patch provided in commit 729aa48 immediately.

Proactive Monitoring: Monitor local system logs for unusual file access patterns or attempts to access restricted directory paths via the affected management functions.

Compensating Controls: Restrict local user access to the application directories and ensure that the software is executed with the minimum necessary privileges to limit the impact of potential code execution.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate attention to prevent local privilege escalation or system takeover. Administrators should prioritize applying the fix provided in commit 729aa48 to neutralize the directory traversal path.