This vulnerability involves a path traversal issue in the Toonflow-app's downloadApp endpoint, where manipulation of the URL parameter could allow unauthorized file path access. The affected versions are 1.1.0 and 1.1.1. The vendor indicates that the URL used for updates is hardcoded in the official codebase, limiting the risk unless the user modifies the code. The attack complexity is high, and exploitability is difficult. There is no official patch or remediation level provided. The CVSS 4.0 score is 2.3, reflecting low severity.

If exploited, this vulnerability could allow an attacker to perform path traversal via the downloadApp endpoint, potentially accessing unauthorized files. However, due to the static compilation of the update URL in the official code and the high complexity of exploitation, the practical impact is limited. There are no known exploits in the wild, and the vendor doubts the real existence of the vulnerability under normal usage conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor notes that the update URL is statically compiled and not modifiable by default users, which mitigates the risk. Users should avoid modifying the official code to prevent exposure. Monitor vendor communications for any future patches or official fixes.