CVE-2026-75333: n/a

The vulnerability in yx-image-recognition v1.0 is a path traversal issue (CWE-22) caused by the direct use of user-supplied parameters (dir, filePath) in file system operations via new File() without any path sanitization or whitelist validation. This allows an attacker to potentially read arbitrary files on the system. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

An attacker can exploit this vulnerability to read arbitrary files on the affected system, leading to a high confidentiality impact. There is no impact on integrity or availability according to the CVSS vector. This could expose sensitive information stored on the file system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid exposing the vulnerable functionality to untrusted inputs or networks and implement manual input validation or sandboxing as a temporary mitigation.