Lumiverse, a full-featured AI chat application, had a severe flaw in its handling of SMB paths. When the primary toSmbPath(fullPath) operation throws an exception, the code falls back to splitting the path into a directory and a basename, but only validates the directory part. The basename is then inserted directly into an smbclient "-c" script without sanitization. SMB interprets the semicolon as a command separator and the sequence !cmd as a local‑shell escape, allowing an attacker to inject arbitrary shell commands. By crafting a path whose directory component is clean yet whose basename contains a sequence like "; !<cmd>; echo ", the attacker can execute <cmd> on the Lumiverse server with the privileges of the running process.

The vulnerability affects Lumiverse versions older than 0.9.7 released by prolix-oc. Any deployment of the aforementioned product that has not yet been upgraded to version 0.9.7 or later is exposed.

The CVSS score of 9.1 indicates a critical impact. Although an EPSS score is not available and the issue is not listed in CISA's KEV catalog, the nature of the flaw—remote command execution via SMB client scripting—provides an attacker with a straightforward exploitation path if SMB access is available. The vulnerability would allow attackers to run arbitrary commands on the host, potentially compromising confidentiality, integrity, and availability of the server and any services running on it.