This vulnerability involves path traversal in the functions JsonMemoryStorage.createDomain, JsonMemoryStorage.getMemories, and JsonMemoryStorage.saveMemories within the aaronsb memory-graph project. The flaw allows a local attacker with limited privileges to manipulate file paths, potentially accessing or modifying files outside intended directories. The project operates on a rolling release basis, so no discrete version numbers are available for affected or fixed releases. The issue was reported early but remains unaddressed by the vendor.

An attacker with local access and limited privileges can exploit this vulnerability to perform path traversal, potentially accessing or modifying files outside the intended scope of the application. The impact is limited by the requirement for local access and the absence of user interaction or elevated privileges. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for updates from the project. No official fix or workaround is currently available.