A weakness in the satya‑vinay Events‑Management‑System, present in any code up to commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a, lets an attacker manipulate the handling of the project.sql file to construct arbitrary file paths. The flaw permits reading of local files or directories, but the CVE description does not provide evidence of write capability or data modification. This vulnerability is classified as a file path manipulation weakness (CWE‑425).

The vulnerable product is the Events‑Management‑System repository maintained by satya‑vinay. Because the project uses a rolling release model, no specific patch version is indicated; any deployment that includes code before the mentioned commit remains affected until a fix is applied.

The CVSS score of 6.9 indicates moderate risk. EPSS data is not available, yet a publicly available exploit demonstrates that the flaw can be abused remotely without authentication. Since the vulnerability is not listed in CISA’s KEV catalog, there is no mandatory remediation requirement, but the possibility of unauthenticated file disclosure warrants swift action.