A relative path traversal flaw in Microsoft Visual Studio Code's Live Preview extension allows an unauthorized local attacker to read files outside the intended project directory. The vulnerability permits disclosure of potentially sensitive data stored on the victim's machine. The weakness is a classic pathname traversal issue and is classified under CWE-22 and CWE-23.

The vulnerable component is the Live Preview extension supplied by Microsoft for Visual Studio Code. No specific version range is enumerated, so all installations of the extension that have not been patched are potentially affected.

The CVSS score of 5.5 indicates a medium severity impact. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw requires local presence, the attack surface is limited to users who have access to the target machine and can install or otherwise execute the extension. Exploitation would involve manipulating file paths passed to the preview functionality to access arbitrary files within the system's file space.