This vulnerability in griptape-ai griptape 0.19.4 affects the FileManagerTool component's functions load_files_from_disk, list_files_from_disk, save_content_to_file, and save_memory_artifacts_to_disk. These functions improperly handle file paths, enabling path traversal attacks that could allow an attacker with low privileges to access or modify files outside intended directories. The attack vector is remote and does not require user interaction. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor was notified but has not issued any advisory or patch, and no official remediation guidance is available.

Successful exploitation could allow an attacker with limited privileges to read or write files outside of authorized directories, potentially leading to unauthorized data access or modification. The vulnerability does not require user interaction and can be exploited remotely. However, the impact is limited by the requirement for some level of privileges and the absence of evidence of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider restricting access to the affected functions and limit privileges of users interacting with the FileManagerTool component. Monitor for updates from the vendor and apply patches promptly once available.