CrewAI's JSON loader allows an attacker to read arbitrary files on the server because the tool accepts any file path without validation. This constitutes a Path Traversal flaw that can lead to the disclosure of sensitive configuration files, credentials, or other confidential data, thereby affecting the confidentiality of the system.

The vulnerability affects the CrewAI product, specifically version 1.0, as identified by the associated CPE string.

The CVSS score of 7.5 indicates a high potential impact, while the EPSS score of less than 1 percent suggests that exploitation is currently unlikely but not impossible. The flaw is not listed in the CISA KEV catalog, and no official workaround is available, so the attack vector is assumed to be local, through the JSON loader functionality.