OpenSave up to version 2.4.0 does not validate the file paths supplied by peers when handling a manifest request. This flaw permits an attacker to instruct the program to read from or write to any file or directory outside the approved save locations. The attack can compromise confidentiality by reading sensitive files and affect integrity by overwriting or dropping files. The weakness is classified as External Control of File Name or Path (CWE-73).

Liquid‑co OpenSave up to and including 2.4.0 is affected. Systems running OpenSave v2.4.0 or earlier are vulnerable until patched. No specific patch version is listed, but any update beyond 2.4.0 fixes the issue.

With a CVSS score of 8.6 the vulnerability is considered high severity. The EPSS score is currently unavailable, but the lack of a KEV listing suggests no widespread exploitation reports yet. An exploitable path exists when an application accepts a peer in the P2P network that supplies a manifest containing a payload path. If an attacker can become a connected peer, they can read or overwrite any file path on the target system, subject to local file system permissions.