The vulnerability allows an attacker to supply specially crafted filenames or paths that bypass the intended upload folder restriction. This can expose sensitive files, modify or delete files, and in some cases enable the execution of arbitrary code on the server. The flaw could result in loss of confidentiality, integrity, and potentially remote code execution.

Drupal Media Library Importer modules in versions 0.0.0 through 2.1.6, inclusive, are affected. Any instance using one of these releases without an upgrade is at risk, regardless of configuration because the issue exists in all variants that accept user-supplied filenames or paths.

Exploitation requires only a web request to the import endpoint, so an attacker with any user access can attempt the path traversal. While no public exploit is documented, the standard traversal technique is well-known and could be used locally or remotely. The vulnerability is not listed in CISA's KEV catalog, the EPSS score is < 1%, and the CVSS score of 5.4 indicates moderate severity; still, the potential impact of file disclosure, modification, or code execution places the risk in the moderate to high range for publicly exposed websites.