DeepTutor 1.4.0 contains a path traversal vulnerability in the EditFileTool.execute method. The flaw allows an attacker, through the live tutorbot WebSocket interface, to write or edit files outside the intended bot workspace. Based on the description, it is inferred that malicious files could be placed in system directories or executable locations, potentially enabling code execution when the bot service later processes those files.

The vulnerability is present in any deployment of DeepTutor version 1.4.0 that exposes the EditFileTool over its WebSocket endpoint. No vendor is listed, but the product in question is the DeepTutor WebSocket tutoring platform.

The CVSS score of 9.8 indicates a critical severity level. The EPSS score of less than 1% suggests that exploitation is not yet widespread. Because the attack vector uses a remote WebSocket interface, an attacker only needs network access to the service. If the DeepTutor process runs with elevated privileges, the overwritten files could potentially lead to full host compromise, though this outcome is inferred from the nature of the path traversal flaw.