The vulnerability originates from how the get_simulation_posts function handles the Platform query parameter in MiroFish’s Query Parameter Handler. An attacker can supply a crafted Platform value containing directory traversal sequences, causing the application to resolve a path outside the intended base directory. This flaw permits unauthorized reading or modification of files whose location is beyond the protected data directory, thereby compromising the confidentiality and integrity of system files. The weakness is a classic example of CWE‑22, in which path resolution is not properly validated.

This issue affects the 666ghj MiroFish application, versions up to and including 0.1.2. There is no evidence that versions beyond 0.1.2 contain the fix. System administrators should confirm the deployed version against the vendor’s release notes to determine if the vulnerability is present.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The description states that the exploitation can be performed remotely by sending a crafted HTTP request to the /simulation endpoint with a malicious Platform parameter, which will trigger arbitrary file access without authentication.