An attacker can supply a crafted path to the /api/static/{deployKey}/ endpoint in Yu AI Code Mother version 4.3. The input path is concatenated directly to the preview root directory without any normalization or validation, enabling the attacker to read arbitrary files on the host. This flaw is a classic path traversal vulnerability (CWE‑22) and can lead to unauthorized disclosure of confidential information stored outside the intended preview directory.

Yu AI Code Mother v4.3, specifically the static resource interface located at /api/static/{deployKey}/. No other versions or products are listed as affected by the available data.

Because the exploit requires no authentication and can be triggered by any visitor to the endpoint, the attack vector is essentially anonymous remote access. The CVSS score of 9.8 indicates a critical severity, while the EPSS score of <1% shows low overall exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but that does not diminish its potential impact. Based on the description, it is inferred that an attacker who can determine the deployment key before exploitation will be able to retrieve files outside the intended root, exposing sensitive information and possibly providing footholds for further attacks.