This vulnerability exists in the ToolController.download function of kerwincui FastBee (up to version 1.2.1). By manipulating the fileName parameter, an attacker can perform a path traversal attack, potentially accessing files outside the intended directory. The attack can be executed remotely without user interaction and requires low privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality. The vendor has not provided any remediation or patch, and the exploit has been made public.

Successful exploitation allows an attacker to read arbitrary files on the server running FastBee, which may lead to information disclosure. The impact is limited to confidentiality with low severity, and no integrity or availability impact is indicated. Because the exploit is public, there is an increased risk of unauthorized data access. However, no known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as restricting access to the affected endpoint, validating and sanitizing input parameters to prevent path traversal, or isolating the application environment until a patch is released.