This vulnerability in Tarot, Astro & Healing v11.4.0 involves an arbitrary file overwrite during the file import process. Exploitation could allow an attacker to overwrite important internal files, potentially resulting in arbitrary code execution or leakage of sensitive data. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction. The weakness corresponds to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to high impact outcomes including arbitrary code execution and exposure of sensitive information. The vulnerability allows remote attackers to overwrite files without privileges, which could compromise system integrity and confidentiality. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently available. Until a patch is released, users should exercise caution with file imports and restrict access to the affected version 11.4.0 where possible.