The vulnerability resides in the Path.resolve function of the FileSystemServerFactory component. Manipulation of input parameters can cause the function to resolve paths outside the intended directory, enabling an attacker to read or modify arbitrary files on the server. This Path Traversal weakness permits remote exploitation, potentially exposing confidential data, breaking confidentiality, and affecting integrity by allowing unauthorized file changes.

Vendor Aklivity and its Zilla product are affected. All versions up to 1.3.4, 2.4.7, and 2.5.0-rc2 contain the flaw; users should review their deployment to confirm the installed version falls within the affected range.

The CVSS score of 6.9 classifies the flaw as Medium severity. EPSS data is not available, but a publicly available exploit for this path traversal exists, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via the http-filesystem binding, where an attacker sends specially crafted parameters to the Path.resolve API to navigate directories and access files beyond the intended scope.