This vulnerability is a classic path traversal flaw that enables an attacker to write arbitrary files to the host system when a Ferret operator scrapes a website. Because the IO::FS::WRITE function accepts filenames supplied by the site, a malicious site can embed "../" sequences in its returned filenames. The attacker consequently controls both the target path and the content of the written file, allowing deployment of cron jobs, SSH authorized_keys, shell profiles or web shells that can execute code with the Ferret process privilege. The weakness is reflected in CWE-22 (Path Traversal) and CWE-73 (OS Command Injection via Untrusted File Name).

The issue affects every installation of MontFerret Ferret up to the 2.0.0‑alpha.3 release. Any deployment running version 2.0.0‑alpha.3 or earlier is subject to the flaw, while 2.0.0‑alpha.4 and newer contain the fix. Specific affected CPEs include montferret:ferret with any minor version prior to alpha.4.

The CVSS score of 8.1 categorizes this as a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation is currently rare or unverified, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an operator who unknowingly scrapes a malicious site; the attacker would host a site that returns filenames with directory traversal sequences, causing Ferret to write files to arbitrary locations on the host machine. The vulnerability is exploitable with standard web scraping workflows, and no additional privileged access appears required beyond running Ferret.