An unauthenticated path traversal vulnerability in yx-image-recognition version 1.0 allows remote attackers to perform unauthorized file system access.

This is a path traversal vulnerability where the application fails to validate the dir and filePath parameters, allowing an unauthenticated attacker to manipulate file paths during file system operations.

The vulnerability carries a CVSS score of 7.5, classifying it as a high-severity risk due to the potential for unauthorized access to sensitive files on the host system. Successful exploitation could lead to significant data exposure or the disclosure of configuration files, potentially facilitating further attacks against the infrastructure.

Immediate Action: As no official patch is currently available, users should restrict access to the affected service or disable the image recognition functionality until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor web server and application logs for suspicious directory traversal patterns, such as sequences including dot-dot-slash characters, targeting the identified parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing path traversal payloads directed at the vulnerable parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as referenced in the security researcher report.

Given the high CVSS score and the presence of a published proof-of-concept, this vulnerability poses a credible risk to the confidentiality of system data. Organizations currently utilizing yx-image-recognition v1.0 must prioritize the implementation of compensating controls, such as WAF filtering, and monitor for vendor updates to address this flaw permanently.