The deleteImage function in Jevon‑Zhong Ai‑doctor 0.0.1 is vulnerable to a path traversal flaw. By manipulating the imagePath argument, an attacker with local access can cause the server to reference directories outside the intended file repository, potentially leading to deletion or modification of arbitrary files within the system. This weakness is classified as CWE‑22 and could compromise the integrity of the application and its data.

Affected Systems: Jevon‑Zhong Ai‑doctor 0.0.1, specifically the ai‑doctor‑server component that exposes the filemanagement service. The vulnerability is present in the file ai‑doctor‑server/src/filemanagement/filemanagement.service.ts and requires the target to run the vulnerable version of the service.

Risk and Exploitability: The CVSS score is 4.8, indicating a moderate impact. The flaw can only be exploited locally, as the attacker must be able to invoke the deleteImage endpoint from within the host. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been actively exploited in the wild. However, the path traversal could allow local adversaries to delete or alter critical files, so the risk is non‑negligible for environments where the application runs with elevated privileges.