A directory traversal vulnerability in fohrloop dash‑uploader exposes the file upload handler to arbitrary path manipulation. By forging a request that includes traversal sequences such as "/../" to bypass the intended temporary upload directory, an attacker can cause the server to write or execute files in directories under its control. This flaw is triggered through the get_temp_root and _post methods of httprequesthandler.py and enables execution of malicious code on the host, effectively granting full control over the impact scope. This vulnerability is a classic instance of the CWE-22 Directory Traversal weakness.

fohrloop dash‑uploader releases from 0.1.0 through 0.7.0a2 are affected. Any deployment that exposes the upload endpoint to external traffic can be exploited; the CVE description does not provide details about authentication or network segmentation requirements.

The vulnerability carries a CVSS score of 9.8 and an EPSS score of 0.06538, indicating an extremely low likelihood of exploitation in realistic attacker scenarios. The flaw is not listed in the CISA KEV catalog yet, but its severity and exploitable remote nature make it a critical risk. Attackers can trigger the flaw by sending a specially crafted HTTP request to the upload endpoint, where the traversal is interpreted by the server and arbitrary code is executed.