This vulnerability allows a repository reader who has cache-deploy permission to access content beyond the intended upstream path configuration. The flaw is a path traversal issue (CWE-22) that could lead to unauthorized read access to content. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with high complexity and low privileges required, resulting in high confidentiality impact but no integrity or availability impact. No patch or remediation details are provided, and it is not a cloud service, so vendor-managed remediation does not apply.

An attacker with cache-deploy permission can read content outside the configured upstream path, potentially exposing sensitive information. The impact is limited to confidentiality and does not affect integrity or availability. The vulnerability requires low privileges but high attack complexity, reducing the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict cache-deploy permissions to trusted users only and monitor for unusual access patterns related to repository content.