The path traversal vulnerability (CWE-22) in moritzmyrz coursevault-preview affects versions before 0.1.1. The resolveSafe utility attempts to restrict file access to a configured base directory by checking if the normalized path starts with the base directory string. However, this check is insufficient because it can be bypassed when a sibling directory shares the same prefix as the base directory, allowing an attacker to read arbitrary files outside the intended directory. This vulnerability has a CVSS 3.1 score of 5.1, indicating medium severity. No official patch link or vendor advisory is provided, but the vulnerability is fixed in version 0.1.1.

An attacker who can control the relativePath argument may read files outside the intended base directory, potentially exposing sensitive information. The vulnerability does not affect integrity or availability, only confidentiality. There are no known exploits in the wild as of the published date.

Upgrade coursevault-preview to version 0.1.1 or later, where this path traversal vulnerability is fixed. Since no official patch link or advisory is provided, verify the version update from the vendor or source repository before deployment. Patch status is not yet confirmed via vendor advisory; check the vendor's official channels for current remediation guidance.