The flaw resides in the Media Generation API’s saveGeneratedImages function, where the output_path argument is accepted without validation. This allows an attacker to craft a path that traverses directories and includes local files. As a result, publicly exposed API calls that accept a custom output_path can read or manipulate files outside the intended storage location, risking confidential data leakage or unauthorized modification. The vulnerability is classified as CWE‑73, a directory traversal weakness that directly compromises confidentiality and integrity of local filesystem data.

EKKOLearnAI ekko‑studio versions up to and including 1.0.6 are affected. The issue is present in packages/server/src/modules/studio/controllers/media.ts within the Media Generation API component.

The vulnerability carries a CVSS score of 5.3, indicating a moderate risk level. Exploitation is possible remotely via crafted API requests, but no public exploit has been documented; the EPSS score is currently unavailable and the issue is not listed in CISA’s KEV catalog. An attacker who can send requests to the Media Generation API can potentially read arbitrary files on the host, which may include configuration data, credentials, or other sensitive content. This risk is amplified if the API is exposed to untrusted users or the internet.