This vulnerability in elecV2 elecV2P (up to version 3.8.3) involves improper handling of the URL argument in the /store/:key route, specifically in the path.join function, which leads to a path traversal condition. This allows an unauthenticated remote attacker to potentially access files outside the intended directory structure. The vulnerability has been publicly disclosed, but no official fix or patch has been released by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server by traversing directories via crafted URL input. This could lead to unauthorized disclosure of sensitive information. However, there is no indication of privilege escalation, code execution, or other impacts beyond information disclosure. No known active exploitation has been reported.

As of the current information, no official patch or fix has been released by the vendor. Users of elecV2 elecV2P versions up to 3.8.3 should consider restricting access to the affected endpoint or implementing input validation to prevent path traversal attempts. Monitor the vendor's channels for updates and apply any forthcoming patches promptly. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.