This vulnerability is an unrestricted file rename in the /api/create-user endpoint of bookcars v8.3. An attacker who is already authenticated can supply directory traversal sequences in the file path to move files from temporary storage to any location on the server. The attacker may read sensitive files, overwrite critical application files, or execute code. The flaw originates from insufficient input validation of file names, effectively allowing arbitrary file manipulation.

The affected software is bookcars version 8.3. No vendor or additional product information is provided. The flaw is present in the /api/create-user component, and any deployed instance running this version is vulnerable.

The vulnerability provides remote code execution once triggered. The EPSS score of < 1% indicates a low but non‑zero exploitation likelihood, and the CVE is not listed in the CISA KEV catalog. The presence of an authentication requirement combined with directory traversal indicates a potentially high exploitation risk, especially for systems exposing guest or administrative APIs. Attackers would need valid credentials to reach /api/create-user, but once authenticated they could elevate privileges by moving files to executable or configuration locations. The CVSS score is 8.8, indicating high severity.