A flaw exists in the getSkillVersionsDir function of the skill-vision-control utility, where an attacker can supply a crafted skillName argument that causes relative paths to be traversed. The resulting path traversal permits the attacker to access files outside the intended directory, potentially reading or writing sensitive data. This weakness corresponds to CWE-22 and can result in unauthorized disclosure or modification of local files, though it does not enable remote code execution.

The vulnerability affects the Jane-xiaoer skill-vision-control application, specifically all releases up to version 1.3.0. The impacted code resides in src/svc/utils/config.ts within the mentioned product. No other vendors or products are listed in the CNA data.

The CVSS base score is 4.8, indicating medium severity, and the EPSS score is not available. The issue is not cataloged in the CISA KEV list. Because the attack requires local access to the system, the scope of exploitation is limited to insiders or compromised local administrators. No publicly known exploits are reported, but the path traversal could be combined with other local privilege escalation techniques if the attacker gains sufficient file system permissions. The safest assumption is that the threat remains low to moderate until a patch becomes available.