A flaw in the importFromMarkdown function of the BackupService allows an attacker to manipulate the File argument and perform a path traversal attack. This weakness can be used to read or write files outside the intended directory, potentially exposing sensitive data or overwriting critical files. The vulnerability is classified as CWE-22.

The issue affects the bolo-blog bolo-solo project, specifically versions up to and including 2.6.4. The vulnerability resides in the Filename Handler component of the BackupService class.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Although the exploit has been published and can be performed from remote, the low EPSS score and lack of widespread public exploitation reduce the immediate risk compared to higher score vulnerabilities. It remains an actionable threat for organizations running affected versions.