This vulnerability involves a path traversal flaw in the MQTT Message Handler component of FedML-AI FedML (versions 0.8.0 through 0.8.9). By manipulating the dataSet argument in a function within FileUtils.java, an attacker can traverse directories and potentially access files outside the intended scope. The vulnerability is remotely exploitable without requiring user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. No official remediation or patch has been disclosed by the vendor, and public exploits are available.

Successful exploitation allows an attacker to perform path traversal, potentially accessing or manipulating files outside the intended directory structure. This could lead to unauthorized disclosure or modification of sensitive files. The vulnerability is remotely exploitable without privileges or user interaction. However, the CVSS impact metrics indicate limited confidentiality impact and no integrity or availability impact, suggesting the scope of damage may be constrained.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, restricting network access to the MQTT Message Handler component and validating or sanitizing input parameters related to dataSet may reduce risk.