The vulnerability resides in Devika v1.0, where the function Coder.save_code_to_project lacks proper validation of file paths. This omission allows an attacker who can invoke the function to specify a file path that escapes the intended project directory and is written elsewhere on the filesystem. The ability to create or overwrite files beyond the designated workspace can compromise the confidentiality, integrity, and availability of files outside the project sandbox.

All installations of Devika version 1.0 are affected, as no specific subsets of functionality are limited. The product is identified only by the repository name; no vendor or additional product variants are listed in the CNA data.

Because the vulnerability permits write access outside a controlled directory, it can affect confidentiality, integrity, and availability of the host system. The CVSS score of 8.8 indicates high severity, while the EPSS score of <1% suggests that exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog, indicating that known exploits are not yet widely documented. The most likely attack vector is an attacker who can trigger the save function, which may be through local access or unauthenticated API endpoints if the application is exposed. Proper exploitation requires that the attacker can control the path parameter and that the affected system permits write operations outside the intended directory.