The vulnerability resides in the path.join function used to process the :key argument of the /store endpoint. An attacker can manipulate the URL to include path traversal sequences, allowing the application to read or write files outside the intended directory. This bypasses the intended confinement of user‑supplied data and can lead to disclosure of sensitive files or modification of critical resources, as dictated by CWE‑22.

This issue affects the elecV2 elecV2P project, specifically all releases up to and including version 3.8.3. The path traversal occurs in the code that processes the :key parameter in the /store route of the application.

The severity is scored 6.9 on the CVSS scale, indicating moderate risk. No EPSS value is available, and the vulnerability is not currently listed in the CISA KEV catalog. The description states that the attack can be carried out remotely via a crafted URL, and the public release of the exploit confirms that remote exploitation is feasible. Without mitigation, an attacker with network access to the server could send a specially crafted request to the /store endpoint and traverse directories to read or modify arbitrary files.