An attacker can supply a crafted path to the /api/static/{deployKey}/ endpoint in Yu AI Code Mother version 4.3. The input path is concatenated directly to the preview root directory without any normalization or validation, enabling the attacker to read arbitrary files on the host. This flaw is a classic path traversal vulnerability (CWE‑22) and can lead to unauthorized disclosure of confidential information stored outside the intended preview directory.

Yu AI Code Mother v4.3, specifically the static resource interface located at /api/static/{deployKey}/. No other versions or products are listed as affected by the available data.

Because the exploit requires no authentication and can be triggered by any visitor to the endpoint, the attack vector is essentially anonymous remote access. Although a CVSS score or EPSS measure is not provided, the severity can be considered high due to the unrestricted file access. The vulnerability is not currently listed in the CISA KEV catalog, but that does not diminish its potential impact. An attacker who can enumerate the deployment keys will be able to retrieve files outside the intended root, exposing sensitive information and possibly providing footholds for further attacks.