A path traversal flaw exists in the page.html handling functions of volotat Anagnorisis up to version 0.4.2. The flaw allows an attacker to manipulate file paths when calling get_file_content, save_file_content, move_files, or start_streaming. This manipulation can result in reading or overwriting arbitrary files on the server, exposing sensitive data or facilitating further compromise.

volotat Anagnorisis versions 0.4.2 and earlier are vulnerable. The issue manifests in the page.html component of the front‑end, and the path traversal can be triggered from any remote client that can reach the exposed web interface.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Because the attack can be initiated remotely and the exploit is publicly disclosed, the likelihood of exploitation is non‑negligible. An attacker could use the flaw to read confidential files or overwrite application files, potentially enabling persistence or further attacks.