The ai-goofish-monitor product from Usagi-org contains an unauthenticated arbitrary file read vulnerability (CWE-36) in its GET /api/prompts/{filename} endpoint on Windows deployments. The vulnerability allows remote attackers to bypass the incomplete path traversal guard, which only blocks forward slashes and '..', by supplying absolute Windows paths or backslash-based traversal sequences. This causes the os.path.join function to discard the intended prompts directory prefix, enabling attackers to read arbitrary files accessible to the application process. The vulnerability affects all versions of the product. There is no vendor advisory or patch available at this time.

An unauthenticated remote attacker can read arbitrary files on the affected Windows system by exploiting the absolute path traversal vulnerability. This can lead to disclosure of sensitive information accessible to the application process. There is no indication of integrity or availability impact. The vulnerability is rated high severity with a CVSS score of 7.5.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and consider implementing additional input validation or filtering on the filename parameter to block absolute paths and backslash traversal sequences on Windows deployments.