This vulnerability involves directory traversal in the URL path /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} within SAS Studio 9.4. An attacker with limited privileges (PR:L) can remotely manipulate the default file download path to access internal files. However, the vendor disputes the classification of this as a vulnerability because the filesystem paths accessed are allowed for authorized users, implying that exploitation requires legitimate access rights. The CVSS v3.1 score is 7.7, reflecting high confidentiality impact but no integrity or availability impact.

If exploited, an attacker with limited privileges could access internal files that may contain sensitive information, resulting in a confidentiality breach. There is no impact on integrity or availability. The vendor's dispute suggests that only authorized users can access these paths, which may limit the practical impact to users who already have some level of access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor disputes the vulnerability classification and indicates that the accessed paths are allowed for authorized users, no immediate action may be required beyond ensuring that user privileges are properly managed and restricted. Monitor vendor communications for any official fixes or updates.