A flaw in remotion remotion v4.0.409 permits an attacker to write arbitrary files to the file system. The vulnerability can be used to overwrite critical files or deploy malicious payloads, leading to potential code execution, data tampering, or system compromise. The weakness is categorized as CWE-123, which signals insufficient validation of file paths during write operations.

The only identified product affected is remotion remotion, version 4.0.409. No broader vendor or product range is documented, so the impact is confined to systems running that specific version.

The CVSS score of 9.1 marks it as Critical, yet the EPSS score is below 1%, indicating a very low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV, which limits known exploitation evidence. The path to exploitation is inferred to require an attacker with the ability to execute code within the remotion environment or to exploit it remotely through an unprotected interface, but the exact attack vector is not detailed in the advisory.