This vulnerability exists in the getSkillVersionsDir function of the Jane-xiaoer skill-vision-control project (versions 1.0 through 1.3.0). By manipulating the skillName argument, an attacker with local access can perform path traversal, potentially accessing files outside the intended directory. The vulnerability requires local access to exploit and does not involve user interaction. No official patch or remediation has been published by the vendor as of the report date.

The vulnerability allows local attackers to perform path traversal, which could lead to unauthorized access to files on the system. Since exploitation requires local access and no privilege escalation or remote attack vector is indicated, the impact is limited to local threat scenarios. The CVSS 4.8 (medium) score reflects this moderate risk level.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should restrict local access to trusted users only and monitor for any suspicious local activity involving the skill-vision-control software. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.