Redocly CLI versions prior to 2.33.2 have a CWE-22 path traversal vulnerability in the split command. The command uses untrusted input from OpenAPI or AsyncAPI component names and x-codeSamples lang values to construct output paths under the --outDir directory without proper validation. If these inputs contain '../' traversal sequences, the command can write files outside the intended directory. However, the component data is limited to YAML or JSON, and code-sample filenames are based on HTTP methods, so arbitrary content file writes are not possible. The vulnerability is resolved in version 2.33.2.

An attacker providing crafted OpenAPI or AsyncAPI descriptions with traversal sequences in component names or x-codeSamples lang values could cause the split command to write or overwrite files outside the designated output directory. This could lead to limited integrity impact by overwriting files, but does not allow arbitrary content writes or confidentiality breaches. The CVSS score is 4.4 (medium severity) reflecting limited impact and local attack vector with user interaction required.

Upgrade to Redocly CLI version 2.33.2 or later, where this path traversal vulnerability is fixed. No other mitigation is required as the issue is resolved in the official fix.