The updateStoryboardUrl function in replaceUrl.ts allows manipulation of the url argument, leading to a path traversal vulnerability that could expose or alter files outside the intended directory. This flaw can be triggered remotely by supplying crafted URLs, and a publicly available exploit exists, though the vendor notes uncertainty about its efficacy in production. The interface is intended to receive only local or docker‑configured addresses, so the risk is highest if the code is modified or the endpoint is exposed to untrusted input.

HBAI‑Ltd Toonflow‑app versions up to 1.1.1 are affected. No other versions or products are specifically listed.

The CVSS score of 5.3 indicates moderate severity. EPSS shows an exploitation probability below 1%, and the vulnerability is not listed in CISA KEV, suggesting limited widespread exploitation. The attack vector is remotely accessible via the exposed updateStoryboardUrl endpoint; an attacker can use unsanitized URLs to read or write arbitrary files, potentially compromising confidentiality or enabling further attacks if the application runs with elevated privileges.