A path traversal flaw in the mustafaakin/cast-localvideo application allows an unauthenticated attacker to read arbitrary files from the server by supplying a specially crafted dir parameter to the app.js handler, which directly passes the value to res.sendFile(). The flaw, identified as CWE-22, permits traversal through absolute paths or '../' sequences, potentially exposing sensitive system files to attackers.

The vulnerability affects all released versions of mustafaakin's cast‑localvideo product. The app is written in Node.js and deployed under the author’s GitHub repository. No specific OS or environment was indicated beyond typical Node.js hosting.

The CVSS score of 7.5 reflects a high severity impact: unauthenticated remote exploitation leads to information disclosure. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by issuing a crafted HTTP request to the server’s endpoint that accepts the dir parameter, without needing credentials or additional constraints.