The weakness resides in the static file handling component of blackms aistack, specifically in the server.ts module. By supplying a crafted request URL that includes directory traversal sequences, an attacker can induce the server to resolve file paths outside the designated web‑root. This allows an unauthenticated remote actor to read arbitrary files on the host operating system, potentially exposing configuration data, sensitive documents, or source code. The flaw is a classic example of CWE‑22: Path Traversal.

The issue affects all releases of the open‑source project blackms aistack up to and including version 1.6.1. Deployments that have not upgraded beyond this release are vulnerable. The project is maintained on GitHub, and vulnerability reports have been submitted but no fix has been released yet.

The CVSS score of 6.9 indicates a moderate to high severity. The exploit is publicly available and can be executed over the network without authentication, suggesting that the attack vector is remote HTTP requests. While the EPSS score is not published, the availability of a public exploit and the lack of mitigation from the vendor raise the likelihood that the vulnerability may be actively exploited. Successful exploitation grants read access to files, which could facilitate privilege escalation or future attacks.