The vulnerability arises from @quasar/app-vite SSG page definitions that were concatenated with the build distribution directory without validating the resulting path. An attacker who can influence the page definition data can embed path components such as '..' or craft symlink references to place generated HTML files or other content outside the intended output tree, where the build process runs with expanded permissions. Consequently, the attacker can create arbitrary files or directories beyond the distribution boundary, potentially exposing sensitive information or enabling further payload delivery. This issue, available in Quasar Framework versions 3.1.0 through 3.2.x, was addressed in version 3.3.0, which now sanitizes the path components.

Affected products include Quasar Framework's @quasar/app-vite component used for static site generation, and the core quasarframework package. The problem exists only in releases from 3.1.0 up to, but not including, 3.3.0. Version 3.3.0 and later contain the fix, thereby eliminating the path traversal risk. Administrators should verify the installed version of @quasar/app-vite to determine whether remediation is required.

The CVSS score of 5.7 indicates a moderate severity, and the exploitability depends on the ability to supply untrusted page definition content during the build step. Because the flaw is limited to the build environment, it is not a direct remote code execution vector, but it can still lead to privilege escalation if the build user has elevated rights. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that while the risk is real, the likelihood of widespread exploitation remains uncertain. Mitigating the vulnerability requires ensuring that only trusted configuration sources are used and that the build environment runs with the least privilege necessary.