The eventcatalog SDK contains a path traversal flaw in the Custom Documentation Helpers module. An attacker who can influence the options.path argument of getCustomDoc, writeCustomDoc, or rmCustomDoc can cause the SDK to access, create, or delete files outside the intended directory. The CWE-22 weakness permits unauthorized local file manipulation, potentially exposing configuration files or altering documentation resources. Although the vulnerability is limited to local execution, an attacker on the same host could read or overwrite sensitive files.

Vendors using the eventcatalog SDK in versions up to 2.29.0 are affected. The flaw resides in the packages/sdk/src/custom-docs.ts file of the SDK component. Upgrading to version 2.30.0 or later removes the vulnerability.

The CVSS score of 4.8 indicates moderate severity, and no EPSS score is provided, suggesting low exploitation probability. The vulnerability is not listed in CISA KEV, implying no known widespread exploitation. The likely attack vector is local, requiring the attacker to run code within the same system as the SDK. Absent a remote execution vector, the risk is limited to compromised hosts.