This vulnerability in jsbroks COCO Annotator (<= 0.11.1) involves improper validation of the folder argument in the backend/webserver/api/datasets.py Data Endpoint. An attacker can remotely exploit this flaw to perform path traversal, potentially accessing unauthorized files on the server. The vulnerability is confirmed with a CVSS 4.0 score of 5.3 (medium severity). Although the exploit is publicly available, the vendor has not issued any patch or official fix as of the publication date.

Successful exploitation of this vulnerability allows an attacker to traverse directories on the server hosting the COCO Annotator application, potentially accessing sensitive files outside the intended directory scope. This could lead to unauthorized information disclosure. There is no indication of privilege escalation, denial of service, or code execution from the provided data. The medium CVSS score reflects moderate impact due to remote exploitability without user interaction but limited scope and complexity.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor the vendor's channels for any future updates or patches. Until a fix is released, consider restricting access to the affected endpoint, implementing network-level controls to limit exposure, or applying custom input validation to mitigate path traversal attempts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.