CloakBrowser’s cloakserve CDP multiplexer incorrectly uses the user-supplied fingerprint query parameter as a directly concatenated filesystem path component when creating Chrome profile directories. The vulnerability is a classic directory traversal flaw, classified as CWE‑22, that allows an unauthenticated attacker to supply a crafted fingerprint value containing traversal sequences. When Chrome fails to launch or the process is cleaned up, the cleanup routine uses shutil.rmtree() to remove the profile directory, which deletes the resolved traversed path. Consequently, an attacker can delete any directory located outside the intended data directory, causing data loss and potentially disrupting system operation. This flaw does not provide code execution but can lead to significant integrity and availability damage.

The flaw exists in CloakHQ CloakBrowser versions prior to 0.3.28. The service, cloakserve, binds to 0.0.0.0 by default, making it accessible over the network. An unauthenticated client can reach the cloakserve port and trigger the directory deletion by sending the malicious fingerprint parameter. Users running older CloakBrowser instances without network restriction are directly exposed to this threat.

The CVSS score of 8.8 reflects a high‑severity impact. EPSS is not available, but the lack of authentication and the service’s global binding increase the likelihood of exploitation. The flaw is not listed in CISA KEV, but it can be proactively mitigated by upgrading to version 0.3.28. Attackers would send a specially crafted fingerprint value over the cloakserve port to trigger arbitrary directory deletion.