The reported flaw lies in the z.url function of the downloadApp endpoint for HBAI-Ltd Toonflow-app. The function accepts a URL argument that, if improperly handled, could resolve file system paths outside the intended directory, enabling path traversal. However, the CVE description states that the "real existence of this vulnerability is still doubted at the moment" and the vendor has explained that the update URL is statically compiled into the code; unless the code is modified by a user, the request will target the official source address. Accordingly, the existence and exploitable nature of the flaw remain unconfirmed, though the mechanism described suggests a potential for unauthorized file access if the conditions were met.

All installations of HBAI‑Ltd Toonflow‑app up to version 1.1.1 may contain the flaw described in the CVE. No newer releases have been cited in the vendor data, so the risk profile applies to any deployment within this version range until an official fix is disclosed.

The CVSS score of 2.3 indicates a low overall risk, and the EPSS score of < 1 % points to a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. While remote exploitation is theoretically possible via the publicly exposed downloadApp endpoint, the vendor’s comments and the high launch cost described in the CVE suggest that successful attacks would be difficult if they exist at all.