A path traversal flaw in Entire CLI allows an attacker with push permission on the checkpoints repository to craft malicious SessionID values that are incorporated into filesystem paths when a session is resumed or a checkpoint is rewound. The resulting write can occur outside the intended session directory, enabling the attacker to replace arbitrary files on the victim’s machine. While the CVE does not describe immediate code execution, overwriting files such as configuration scripts, binaries, or executables could lead to privilege escalation or compromise of the host environment.

The vulnerability affects the Entire CLI tool, specifically versions earlier than 0.7.7. Users of this tool that rely on the checkpoint resume or rewind features are at risk unless they have updated to 0.7.7 or later.

The CVSS score of 6.2 places this weakness in the medium severity range; no EPSS score is available and it is not listed in CISA KEV. Exfiltration or execution requires the attacker to have the ability to push to the checks‑points branch of the Git repository, so an insider or compromised account can exploit it. After the malicious SessionID is injected, any user later triggers a resume or rewind, and the arbitrarily written file will be overwritten on the local filesystem. The impact is limited to a single host and requires local execution of resume or rewind steps, but modifying key files could facilitate further attacks.