The vulnerability resides in the writeFile function of the IssueFixer component of Webpro-nl Knip. By manipulating the workspaces argument, an attacker can trigger a path traversal that results in the deletion or overwriting of files on the system. This flaw enables a remote user to execute file write operations beyond the intended boundaries, potentially compromising system integrity.

Webpro-nl Knip versions up to 6.44.0 are affected. The issue is present in the Workspace Handler module employed by this product.

With a CVSS score of 5.3 the flaw presents a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires remote interaction with the Workspace Handler and the ability to supply crafted input; the potential impact includes loss of critical files or destructive overwrites. While exploitation is possible, the exact probability is unknown, though the disclosed nature suggests it may be leveraged by threat actors.