This vulnerability in better-auth better-icons up to version 1.0.5 involves improper handling of the icons_file argument in the scan_project_icons/sync_icon component, enabling local attackers to perform path traversal attacks. This could allow attackers to access or manipulate files outside the intended directory. The vulnerability requires local access with low privileges and does not require user interaction. The vendor has been informed but has not issued a response or patch. No known exploits are reported in the wild.

An attacker with local access and low privileges can exploit this vulnerability to traverse directories and potentially access or modify files outside the intended scope of the application. This could lead to unauthorized disclosure or modification of files, impacting confidentiality and integrity. The vulnerability does not allow remote exploitation or privilege escalation by itself.

No official patch or remediation is currently available from the vendor. Users should restrict local access to trusted users only and monitor for any suspicious local activity involving the better-icons component. Check the vendor advisory regularly for updates or patches addressing this vulnerability.