The flaw is in the calibration_apply function within mistral.rs, where manipulation of the save_cimatrix argument enables path traversal. This allows an attacker to reference files outside the intended directory, potentially exposing sensitive data or allowing unintended file writes if server permissions permit. The vulnerability can affect confidentiality and integrity by exposing or altering file contents.

Mistral.rs, developed by EricLBuehler, is affected in versions up to 0.9.3. The fix is included in version 0.9.4, which closes the path traversal flaw in the server core file mistralrs-server-core/src/handlers.rs.

The CVSS score of 6.9 indicates moderate severity, and while the EPSS score is not available and KEV does not list the vulnerability, the exploit is publicly available and can be triggered remotely by sending a crafted save_cimatrix value. Path traversal usually requires no special privileges, so the risk remains non‑negligible for unprotected deployments.