This vulnerability (CWE-22) in Epiphyt Embed Privacy allows an attacker with low privileges to perform a path traversal attack due to improper restriction of pathnames to a restricted directory. The vulnerability affects versions up to 1.12.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, integrity impact, and high availability impact. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

The vulnerability can be exploited remotely by an attacker with low privileges to perform path traversal, potentially leading to integrity compromise and high availability impact on the affected system. Confidentiality is not impacted according to the CVSS vector. The exact consequences depend on the attacker's ability to leverage the path traversal to modify or disrupt system files or processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor vendor communications for updates and apply patches once available.