The vulnerability is a permission misconfiguration in the GetWriter function of kubescape's result handling output component. Manipulating the outputFile argument can cause the program to create or modify files with inappropriate file system permissions, allowing a user with local access to write files in directories they should not have write rights to or set permissions that expose sensitive data. The weakness is classified under CWE-266 and CWE-275.

Affected versions are all releases of kubescape up to and including 4.0.15. Users running these versions on any operating system are at risk if they invoke kubescape with a crafted outputFile argument. The fix is provided in kubescape v4.0.16 and later, which implements proper validation of the output path. There is no known vendor version information beyond the 4.0.15 boundary.

The severity score of 2.4 indicates a low impact and the vulnerability requires local access; it is not currently listed in CISA's KEV catalog and there is no EPSS score available. Exploitation would likely require the attacker to have a local user account or elevate privileges within the host. Due to its low CVSS and local nature, the risk is limited but patching is still recommended to prevent accidental permission leakage.