The vulnerability is a path traversal flaw in the Kilocode File Diff API Endpoint, specifically in the Bun.file function used by opencode/src/kilocode/review/worktree-diff.ts. By supplying a crafted file argument, an attacker can read arbitrary files on the server’s file system. This flaw maps to CWE-22 and carries a CVSS score of 5.3, indicating a moderate level of severity. The exploit is publicly available and can be used from a remote source because the affected API endpoint is reachable over the network.

Kilo-Org kilocode versions up to and including 7.0.47 are affected. No specific sub‑release information is provided, so any deployment of 7.0.47 or earlier is considered vulnerable.

The flaw allows remote actors to read sensitive files by manipulating the File argument in API calls. No KEV entry is currently assigned, and EPSS data is unavailable, so the precise exploitation probability cannot be quantified. Nevertheless, the publicly disclosed exploit and the remote nature of the attack suggest that the vulnerability is exploitable under normal conditions. Scanners that identify the vulnerable API should be considered at risk until mitigated.