The vulnerability exists in Devika v1.0's Patcher Agent function that persists code to a project. An attacker can craft a file path that traverses directories and writes files outside the designated project workspace, enabling placement of arbitrary files or potentially malicious scripts. This capability directly compromises the integrity and confidentiality of the file system and can lead to further exploitation such as code execution or data exfiltration. The flaw is a classic directory traversal weakness, confirmed by the presence of unvalidated path components used in file creation.

Both developers and users who run Devika v1.0 on any operating system that supports the Patcher Agent are affected, as the path traversal is not limited by environment variables or other constraints. No specific vendor or product version is listed beyond Devika v1.0, so all installations of that version are potentially vulnerable.

Given the CVSS score of 7.5, the vulnerability poses a substantial risk of arbitrary file creation. The EPSS score indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Although the description does not state the exposure level, it is inferred that the Patcher Agent may be reachable over a network or from a compromised process; if exposed, a remote attacker could supply a specially crafted file path at minimal effort. In internal or isolated environments, an attacker would still need to execute the Patcher Agent with sufficient privileges, which limits the likelihood of exploitation. Nevertheless, the potential to write arbitrary files anywhere on the host system makes this a serious file‑system integrity risk.