The yx-image-recognition v1.0 application fails to sanitize or whitelist the dir and filePath parameters before using them in file system operations. This flaw enables an attacker to specify paths containing '..' or other traversal sequences, causing the program to access files outside the intended directory. If successful, the attacker can read arbitrary files on the host, which can disclose sensitive configuration files or source code, and may also enable write operations that could facilitate code injection or tampering.

Affected systems include the yx-image-recognition v1.0 implementation, with no additional product or version information provided. The vulnerability exists specifically in the version 1.0 of the software. No vendor or CNA details are available, so users should review where this package is deployed in their environment.

The risk is moderate to high, depending on exposure. Although the EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, the attack path is straightforward: control of the dir or filePath parameters likely through a public facing API or web form. If the service is reachable from the Internet, an attacker could exploit the flaw without authentication, resulting in arbitrary file disclosure or tampering. The lack of official fixes or workarounds adds to the urgency.