This vulnerability affects the engineer-your-data product by eghuzefa in versions 0.1.0 through 0.1.3. The flaw exists in the read_file, write_file, list_files, and file_inf functions of src/server.py, where the WORKSPACE_PATH argument is not properly sanitized, enabling path traversal attacks. This allows an attacker to access or manipulate files outside the designated workspace directory remotely. The vulnerability is confirmed public and exploitable, but no official remediation or patch has been released by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to read, write, list, or obtain information about files outside the intended workspace directory. This could lead to unauthorized disclosure of sensitive information or modification of files on the affected system. The CVSS 4.0 base score is 6.9, indicating a medium severity impact with network attack vector and no required privileges or user interaction.

As of the current information, no official patch or remediation is available from the vendor. Users should monitor the vendor's communications for updates and consider implementing temporary mitigations such as restricting network access to the affected service or applying application-level controls to validate and sanitize input paths. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.