Blueprint Studio, a VS Code-like editor for Home Assistant configuration files, had a path traversal vulnerability (CWE-22) in its legacy stateless terminal command execution code within custom_components/blueprint_studio/backend/terminal_manager.py. The cwd parameter was only checked for existence, not confinement within the Home Assistant configuration directory. This allowed an administrator using the restricted terminal helper to select directories outside the intended boundary, potentially accessing or modifying host filesystem paths permitted by container and filesystem permissions. The vulnerability is resolved in version 2.5.2.

An administrator with access to the restricted terminal helper could bypass intended filesystem restrictions and access or modify files outside the Home Assistant configuration directory. This weakens the security boundary expected from the helper, potentially exposing sensitive host paths depending on container and filesystem permissions. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low complexity, and limited impact on confidentiality, integrity, and availability.

Upgrade to blueprint-studio version 2.5.2 or later, where this path traversal vulnerability is fixed by properly restricting the working-directory parameter to remain inside the Home Assistant configuration directory. No other mitigation is required once updated.