The vulnerability CVE-2026-7059 exists in 666ghj MiroFish versions 0.1.0 through 0.1.2. It is a path traversal issue in the get_simulation_posts function within backend/app/api/simulation.py, where manipulation of the Platform query parameter allows an attacker to access unintended file system paths. The attack can be executed remotely without authentication. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality. No vendor advisory or patch information is available as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server hosting the vulnerable MiroFish application by manipulating the Platform parameter. This could lead to unauthorized disclosure of sensitive information. The CVSS score of 6.9 reflects a medium severity impact primarily due to confidentiality impact. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or filtering on the Platform parameter to prevent path traversal characters and sequences. Monitoring for unusual access patterns related to this parameter is advisable. Avoid exposing the vulnerable versions in untrusted network environments.