The vulnerability is a classic path traversal flaw in Yank Note’s publicly exposed /api/help endpoint. Unsanitized user input in the path or doc parameters allows an unauthenticated remote attacker to read arbitrary files. Because the app replaces only a single instance of '..' in the path, repeated '../' sequences bypass the check, exposing files such as SSH private keys, configuration files, or stored notes. The flaw can be triggered without authentication, enabling direct read of sensitive data and thus compromising confidentiality.

The flaw affects the YANK NOTE product, distributed by Purocean, in all versions released before 3.93.1. No specific patch versions are listed beyond that release, so any installation running a pre‑3.93.1 build is vulnerable.

Given the lack of authentication required, the attack vector is remote over the network, exposing the endpoint to any user with network reach to the server. The exploit requires no special privileges beyond the ability to send HTTP requests. The CVSS score of 8.2 indicates high severity. Since EPSS is not provided and the vulnerability is not in the KEV catalog, the exact prevalence of exploitation is unknown, but the presence of publicly available example code in the GitHub repository suggests that a determined attacker can craft a request quickly and bypass the minimal sanitization.