The vulnerability in mustafaakin/cast-localvideo arises from improper input validation in the app.js file at lines 151-153, where the req.body.dir parameter is passed directly to res.sendFile() without sanitization. This allows an unauthenticated attacker to perform directory traversal attacks by using absolute paths or ../ sequences, enabling the reading of arbitrary files on the server. The CVSS 3.1 score is 7.5 (High), reflecting the network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact. No patch or official remediation has been provided as of the published date.

An unauthenticated remote attacker can read arbitrary files on the affected server, potentially exposing sensitive system files and data. This compromises confidentiality but does not affect integrity or availability. The vulnerability can be exploited remotely without any authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the req.body.dir parameter to prevent directory traversal sequences. Restricting file access to a safe directory whitelist or using secure APIs that do not allow arbitrary file paths can mitigate the risk.