This vulnerability in bookcars v8.3 allows authenticated users to exploit an unrestricted file rename flaw in the /api/create-user endpoint. By leveraging directory traversal sequences, attackers can relocate files from temporary storage to arbitrary server filesystem locations. This can result in unauthorized disclosure of sensitive information, modification or overwriting of important application files, and potentially remote code execution. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). No known exploits are reported in the wild, and no vendor remediation or patch has been confirmed at this time.

Successful exploitation enables attackers with authentication to access sensitive files they should not have access to, overwrite critical application files potentially disrupting service or integrity, and execute arbitrary code remotely on the affected server. This poses a high risk to confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/create-user component to trusted users only and monitor for suspicious activity related to file operations. Avoid exposing this endpoint to untrusted networks or users.