The coursevault-preview utility before version 0.1.1 has a CWE-22 path traversal vulnerability in its resolveSafe utility. The vulnerability is due to an improper boundary check that uses startsWith(baseDir) on normalized paths, which fails to correctly restrict access to the intended directory. An attacker who can supply the relativePath argument may exploit this to read files outside the configured base directory, particularly when a sibling directory exists with a name sharing the same prefix as baseDir. This vulnerability has a CVSS 3.1 score of 5.1 (medium severity) and is fixed in version 0.1.1.

Successful exploitation allows an attacker with local access (attack vector: local) and high attack complexity to read sensitive files outside the intended directory, potentially exposing confidential information. The vulnerability does not allow modification or denial of service, only confidentiality impact. There are no known exploits in the wild.

Upgrade coursevault-preview to version 0.1.1 or later, where this path traversal vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed by the vendor stating the issue is fixed in 0.1.1.