This vulnerability in FedML-AI FedML (up to version 0.8.9) involves a path traversal flaw in the MQTT Message Handler component's FileUtils.java file. By manipulating the dataSet argument, an attacker can traverse directories outside the intended file path. The vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. No vendor response or patch has been provided as of the publication date.

Successful exploitation allows remote attackers to access or manipulate files outside the intended directory structure, potentially leading to unauthorized information disclosure or modification. The vulnerability does not require user interaction and has low attack complexity, but the impact is limited to file system access without elevation of privileges or integrity/availability impact beyond the path traversal itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as restricting network access to the MQTT Message Handler, validating and sanitizing inputs to the dataSet argument, and monitoring for exploitation attempts. Avoid exposing vulnerable versions to untrusted networks until a fix is released.