The vulnerability exists in the ZIP File Handler of bolo‑solo, where the unpackFilteredZip function fails to validate location paths when extracting files. Passing a crafted file name in the argument causes the extracted file to be written outside the intended directory, enabling attackers to overwrite arbitrary files or read sensitive data. The flaw allows remote exploitation and carries a moderate score for damage potential, meaning an attacker may compromise confidentiality and integrity of system files.

The affected SKU is bolo‑blog's bolo‑solo package, impacting all installations up to version 2.6.4. No official patch version was disclosed at the time of writing, and the product is listed as vulnerable until a corrected release is applied.

The CVSS score of 5.3 places the issue in the moderate band, while the EPSS rating of <1% suggests that automated exploitation is currently unlikely, though the vulnerability is public. It is not flagged in the CISA KEV catalog, but the remote attack vector and lack of vendor response mean that a determined adversary could still leverage this path traversal to tamper with configuration or application files, especially if the API endpoint is reachable from the internet.