Eclipse aeriOS Self‑orchestrator releases before 1.2.1 allow a path traversal flaw in the REST API. User‑supplied identifiers used for creating, updating or deleting resources are concatenated into filesystem paths without proper checks or sanitization. An attacker who can reach the API from an unauthenticated session can inject crafted identifiers containing traversal sequences, enabling them to write or delete JSON files outside the intended directories, subject to the file system rights of the Self‑orchestrator process. The issue has been addressed in version 1.2.1 by introducing validation and sanitization of identifiers before they are used to construct filesystem paths, preventing path separator characters from being used to escape the intended directories.

The vulnerability affects all installations of Eclipse aeriOS Self‑orchestrator that are using a version older than 1.2.1. The issue is confined to the REST API endpoints responsible for resource management in that product, under the Eclipse Foundation’s aeriOS project.

The CVSS score of 8.8 classifies this flaw as high severity. Because the vulnerable endpoints are accessible without authentication, the exploitation requirement is minimal: an unauthenticated remote attacker who can reach the API can supply crafted identifiers to perform file writes or deletions. The container deployment of the application often runs with elevated privileges, increasing the damage that can be inflicted. EPSS data is not yet available; the issue is not listed in CISA KEV, but the lack of authentication and potential for privilege escalation mean that the risk remains significant.