The vulnerability resides in Bleenco Abstruse versions up to 2.1.0, affecting the Cache Endpoint code that uses filepath.Join on a user‑controlled argument named File. A crafted value containing directory traversal sequences can cause the join operation to resolve to arbitrary paths on the host, allowing an attacker to read sensitive files and potentially write or execute code if the relevant permissions exist. The flaw can be triggered remotely through the file server API and has already been publicly disclosed.

All installations of Bleenco Abstruse up to version 2.1.0. No other vendors or product versions are affected. The vulnerability specifically targets the Cache Endpoint component in file server/api/worker/download_cache.go.

The CVSS base score of 6.9 indicates moderate severity. EPSS data are not available and the vulnerability is not listed in CISA's KEV catalog. Because the flaw is exploitable over the network and the exploit has been publicly released, the risk is significant for exposed deployments. Successful exploitation would likely lead to unauthorized disclosure of sensitive files, with a potential for further compromise if the victim process runs with elevated privileges.