The vulnerability resides in the AppFileUtils.createResponseEntity method of yeqifu warehouse. An attacker can manipulate the path argument to traverse directories and read files outside the intended workspace, resulting in remote file read capabilities that may expose sensitive configuration files or other confidential data. This is a classic path traversal flaw (CWE‑22).

All installations of yeqifu warehouse built on or before the commit aaf29962ba407d22d991781de28796ee7b4670e4 are affected. Yeqifu warehouse is deployed as a rolling release, meaning that any version released before the fix may contain the flaw. There are no explicit version numbers for affected or patched releases in the public data.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, yet public exploit code demonstrates that remote attackers could trigger the path traversal if they can send crafted requests to the application. If the web application is exposed to the Internet or an untrusted network, the risk remains of arbitrary file access that could lead to data leakage or privilege escalation.