The flaw resides in the read_file, write_file, list_files, and file_inf functions of src/server.py, where the WORKSPACE_PATH argument can be manipulated to perform path traversal. A remote attacker can supply a crafted value and read, write, or list arbitrary files on the host. The vulnerability is a classic CWE‑22 path traversal flaw that can be exploited to gain unauthorized access to sensitive files. The description indicates the exploit is publicly available and may be used remotely via manipulation of the WORKSPACE_PATH parameter.

The vendor eghuzefa provides the engineer‑your‑data project. Versions up to 0.1.3 are affected. No further product variants or patch levels are listed, so any deployment using 0.1.3 or earlier in the repository is vulnerable.

The CVSS score of 6.9 indicates a moderate impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting it is not a currently recognized high‑profile exploit. The description indicates the exploit is publicly available and may be used remotely through manipulation of the WORKSPACE_PATH parameter. Attackers could trigger the flaw via the exposed interfaces of the server, potentially retrieving sensitive files or disrupting service.