The yx-image-recognition v1.0 application fails to sanitize or whitelist the dir and filePath parameters before using them in file system operations. This flaw allows a user to supply paths containing traversal sequences such as '..', causing the program to access files outside the intended directory. The vulnerability is a classic Path Traversal (CWE-22) that can lead to the disclosure of arbitrary files or, if write operations are permitted, modification of files and potential code injection.

Affected systems include the yx-image-recognition v1.0 implementation. No vendor or CNA details are available, and the vulnerability exists specifically in version 1.0 of the software. Users should verify where this component is deployed in their environment to assess exposure.

The CVSS score of 7.5 indicates a high severity. The EPSS score of <1% reflects a low exploitation probability, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is through a publicly reachable API or web form that accepts raw dir or filePath parameters. If the service is exposed to the Internet, an attacker could exploit the flaw without authentication, enabling arbitrary file reading or potentially writing if write privileges exist.