This vulnerability in Lspace-io lspace-server up to commit 79f02fe5aa8970b210a6a05cf097155f8d9ffd71 involves path traversal via manipulation of the filePath argument in the src/core/repository.ts file's Repositories File API functions (fileExists, readFile, writeFile, deleteFile). The issue allows an attacker with local access to traverse directories and potentially access or modify files outside intended boundaries. Due to the continuous delivery model, no explicit version numbers are provided. No vendor advisory or patch is currently available.

An attacker with local access can exploit this vulnerability to perform path traversal attacks, potentially reading, writing, or deleting files outside the intended directory structure. This could lead to unauthorized data access or modification. However, the attack requires local privileges and does not involve remote exploitation or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should restrict local access to trusted users only and monitor for any suspicious local activity until a patch or official mitigation is released.