This vulnerability in better-auth better-icons up to version 1.0.5 involves improper handling of the icons_file argument within the scan_project_icons/sync_icon component, enabling local attackers to perform path traversal attacks. This can potentially allow attackers to access or manipulate files outside the intended directory. The vulnerability requires local access with low privileges and does not require user interaction. The issue was reported early to the project but remains unaddressed, and the exploit details have been publicly disclosed.

An attacker with local access and low privileges can exploit this vulnerability to traverse directories via the icons_file argument, potentially accessing or modifying files outside the intended scope. The impact is limited by the requirement for local access and low privileges, and the overall severity is medium (CVSS 4.8). There is no indication of remote exploitation or elevated privileges.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should restrict local access to trusted users only and monitor for any suspicious local activity involving the better-icons component. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.