This vulnerability in abracadabra50 claude-sesh 1.0.0 allows local attackers to exploit a path traversal flaw via manipulation of the sessionId argument in the getEnrichedData/enrichSession function located in src/services/enricher.ts. The flaw enables unauthorized access to filesystem paths outside the intended scope. The vulnerability requires local access to launch the attack. A patch exists as indicated by the commit hash 786c9d74800e6d0858b65778f31beb71b3983a50, though no official vendor advisory or remediation level is provided.

Successful exploitation allows an attacker with local access to perform path traversal, potentially accessing or manipulating files outside the intended directory structure. This could lead to unauthorized information disclosure or modification of files accessible by the application. The CVSS score of 4.8 (medium severity) reflects the limited attack vector (local) and the potential impact on confidentiality, integrity, and availability.

A patch identified by commit 786c9d74800e6d0858b65778f31beb71b3983a50 is available and applying it is advised to resolve this issue. Since the vulnerability requires local access, restricting local user permissions and access can reduce risk. Patch status is not explicitly confirmed by a vendor advisory; therefore, check the vendor's official channels for updated remediation guidance.