The vulnerability is a path traversal flaw in the Bun.serve function of the p2r3 convert API, triggered by manipulating the pathname argument. By supplying specially crafted paths, an attacker can read any file on the filesystem that the process has permission to access. This can result in unauthorized disclosure of sensitive data, configuration files, or code. The weakness is identified as CWE‑22.

p2r3 convert, a component that uses a rolling release model. All revisions before commit 6998584ace3e11db66dff0b423612a5cf91de75b are vulnerable. The affected file is buildCache.js within the API module. No discrete version numbers are available due to continuous delivery.

The CVSS score of 5.3 indicates a moderate severity. The exploit is available publicly and can be performed remotely through the exposed API. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the function accepts external input without proper sanitization, the attack vector is likely remote via a crafted HTTP request to Bun.serve.