This vulnerability involves a path traversal flaw in the get_simulation_posts function of the 666ghj MiroFish application (versions 0.1.0 to 0.1.2). The flaw arises from improper validation of the Platform query parameter, allowing an attacker to manipulate the argument to access arbitrary files on the server. The vulnerability is remotely exploitable without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No official fix or patch has been published as of the data provided.

Successful exploitation of this vulnerability allows an attacker to perform path traversal attacks, potentially reading sensitive files on the server hosting the vulnerable application. This could lead to unauthorized disclosure of information. There is no indication of privilege escalation, denial of service, or code execution from the provided data. No confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or filtering on the Platform parameter to prevent path traversal. Monitor vendor channels for updates and apply patches promptly once released.