The vulnerability is a directory traversal flaw located in src/backend/bisheng/linsight/domain/task_exec.py. It allows an attacker to specify file paths that bypass the intended directory boundaries, potentially accessing files outside the application’s designated directory structure.

Affected product is bisheng, versions 2.3.0, 2.4.0, and 2.4.0-beta1.

The EPSS score indicates a very low exploitation probability (< 1%) and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation. Based on the description, it is inferred that an attacker could construct a request that causes the application to resolve a path leading to an arbitrary file on the underlying system. The CVSS score of 7.5 reflects a medium to high severity. Without reports of exploitation, the risk remains moderate to high, depending on the exposure level of the bisheng service and the privilege of the user who can submit task execution requests.