The vulnerability lies in the create_subdirectory function of the dazeb markdown-downloader project. An attacker can supply a specially crafted path that causes the function to resolve outside the designated download directory, resulting in a directory traversal flaw (CWE-22). The flaw allows the creation of files on arbitrary paths on the host file system, potentially exposing or modifying sensitive data and creating conditions that could lead to further compromise.

Any installation of the dazeb markdown-downloader up to commit 3d4394b34b6c99d81af817623af55e3384df5a6a is affected. The project does not publish version numbers, which means that any deployment of the current codebase is potentially vulnerable. No official patch is available, and the repository owner has not responded to reported issues.

The CVSS score of 5.3 indicates moderate severity, and the fact that an exploit is publicly available implies a higher likelihood of use. The EPSS score is not available, so the precise exploitation probability cannot be quantified, but the existence of an exploit indicates that the risk is non‑negligible. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending a remote download request containing a malicious path; no local privilege is required, making the attack straightforward once the service is reachable.