The CVE identifies a path traversal vulnerability in server/sdk-server.ts of the DV0x creative‑ad‑agent component. By manipulating the req.params argument, an attacker can navigate outside the intended directory structure. Classified under CWE‑22, this flaw permits reading arbitrary files and may facilitate remote exploitation, as the exploit is public and can be used.

The affected product is DV0x creative‑ad‑agent, versions up to commit 751b9e5146604dc65049bd0f62dcbdad6212f8a3. The project follows a rolling‑release delivery model, so exact version numbers are not supplied. The security patch corresponding to commit 3d255865a957f3740b8724dd914502c0f44d4970 has been released and should be applied to all deployments that have not yet incorporated this change.

The vulnerability has a medium CVSS score of 6.9, and its EPSS score is not available, but the presence of a publicly available exploit indicates real‑world risk. The attack vector is remote: an attacker can trigger the traversal via any externally reachable API endpoint that accepts req.params. Because the fix is simple and official, applying the patch is the most effective mitigation, and the vulnerability remains unlisted in CISA’s KEV catalog.