An improper restriction of a pathname to a designated directory (path traversal) in Visual Studio Code permits an authorized attacker to expose files or directories over a network. The flaw involves the assignment of a controlled path to a critical function that fails to enforce strict directory boundaries, allowing data that should remain private to be accessed and transmitted externally. The weakness is classified as Path Traversal (CWE‑22) and could lead to accidental leakage of confidential files or configurations. Because the affected data can be retrieved through network channels, confidentiality is the primary impaired asset.

Microsoft Visual Studio Code is the sole supported product for this issue. Precise version numbers are not disclosed in the public advisory, but the vulnerability remains present in all releases until the patch detailed on the Microsoft Security Response Center update guide is applied. Administrators should verify that their installations match the fixed versions listed on the MSRC page and route network access accordingly.

The vulnerability carries a CVSS score of 6.8, indicating moderate severity, and its EPSS score is not reported, so the current likelihood of exploitation is unclear. It is not currently listed in the CISA KEV catalog, suggesting no widespread exploitation reports to date. Likely attack vectors include an authenticated user with sufficient privileges in an environment where Visual Studio Code can bind to external network interfaces; from there, the path traversal can be used to read and send files over the network. The absence of an EPSS figure and KEV listing advises vigilance but does not diminish the need for timely remediation.