The vulnerability is a path traversal condition in the subDir parameter of the media upload API. It allows authenticated users to supply parent‑directory references that are not normalised, enabling the creation of arbitrary directories and the placement of attacker‑controlled files with chosen extensions anywhere the service account can write. This can lead to modification of critical files, introduction of malicious code, or other forms of compromise. The weakness is identified as CWE‑22.

Stonewuu ai‑fusion‑video version 1.2.0 is affected. No other versions are listed.

The CVSS score of 5.3 indicates a moderate severity. Exploitation requires an authenticated session with permission to upload files. Attackers send a POST request to /api/storage/upload and include a subDir value containing '..' sequences. Because the server does not normalise the path, the uploaded content can be written to an arbitrary location. Since the EPSS score is unavailable, the likelihood of exploitation is unknown; however the lack of any KEV listing suggests no widespread exploitation has been observed yet.