The vulnerability in libks's clean_uri() function occurs because it does not properly handle URIs whose path segments exceed the size of its canonicalization buffer. As a result, the function silently allows URIs containing ".." sequences to pass through unfiltered. When these URIs are later combined with filesystem paths by consumers of libks, it can lead to path traversal attacks. This flaw affects all versions of libks before 2.0.11, which includes the vulnerable code. The issue is fixed in version 2.0.11.

An attacker can exploit this vulnerability to perform path traversal attacks by crafting specially formed URIs that bypass the canonicalization step. This can lead to unauthorized access to files outside the intended directory scope. The CVSS score of 7.5 (high) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. There is no impact on integrity or availability reported.

Upgrade libks to version 2.0.11 or later, where the vulnerability is patched. No other mitigation is necessary as the fix is official and addresses the root cause.