The vulnerability is a path traversal flaw in the save_base64_image function of the QR Code Generator plugin for TaskingAI v0.3.0. By manipulating the project_id parameter, an attacker can control the target path of the image file being written, enabling the creation or overwriting of files anywhere on the server’s filesystem. This can lead to the deployment of malicious files, such as executable scripts, that compromise server integrity and confidentiality.

Only the TaskingAI platform version 0.3.0 is affected. The flaw resides in the QR Code Generator plugin bundled with that release. No other TaskingAI versions or plugins have been identified as vulnerable.

Because the flaw allows write operations to arbitrary paths, an attacker who can inject a crafted project_id can directly place malicious code into web‑accessible directories or critical system locations. While no EPSS score is available, and the vulnerability is not listed in CISA KEV, the lack of input validation and the severity of a file write make exploitation potentially high. The CVSS score is 8.1, indicating high severity. A successful exploit could elevate an attacker’s privileges, allow arbitrary code execution, or lead to denial of service by overwriting essential files. The current lack of an official patch means that environment owners should treat this as a high‑risk vulnerability pending an update.