The vulnerability is a pathname traversal flaw in the tsk_recover utility of Sleuth Kit. By providing filenames that contain path‑traversal sequences such as /../ within a filesystem image, the tool writes recovered files to locations outside the intended output directory. This allows an attacker to overwrite arbitrary files, potentially replacing shell configuration files or cron entries and thereby enabling arbitrary code execution.

The flaw affects all releases of Sleuth Kit up to and including version 4.14.0. The vulnerable component is found in the Sleuth Kit project maintained by sleuthkit. Administrators using any distribution of tsk_recover within that version range should consider their installations vulnerable.

The CVSS score of 8.4 indicates high severity, and the EPSS score below 1% suggests a low likelihood of exploitation in the wild. It is not currently listed in the CISA KEV catalog. Based on the description, the attack requires an attacker to supply a crafted filesystem image to tsk_recover and must run the utility with sufficient permissions to write to the target directory; thus the attack vector is local, though it could be abused in a remote context if the tool is invoked by an untrusted user or process.