The vulnerability is a path traversal flaw in the Repositories File API of lspace-server. The flaw allows an attacker with local access to manipulate the filePath argument in fileExists/readFile/writeFile/deleteFile functions, enabling them to read, write, or delete arbitrary files on the host filesystem. This weakness corresponds to CWE‑22 and can lead to local data compromise or destruction if exploited.

The affected product is Lspace‑io lspace‑server. Versions up to the commit 79f02fe5aa8970b210a6a05cf097155f8d9ffd71 contain the flaw. No version ranges are available beyond that commit, so any installation running an older commit may be vulnerable.

The CVSS base score is 4.8 and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the API and the manipulation of a filePath argument; no network or remote exploitation is described. Because it is limited to local users, the overall risk margin is moderate, but the potential impact of unauthorized file access or deletion is significant. Organizations should evaluate whether the application operates with elevated privileges or exposes the vulnerable API to untrusted local processes.