This vulnerability in jsbroks COCO Annotator (<= 0.11.1) allows remote attackers to perform path traversal via manipulation of the 'folder' argument in the Data Endpoint's backend/webserver/api/datasets.py file. This could enable unauthorized access to files outside the intended directory. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality. The vendor has not provided a patch or official fix, and the exploit is publicly available.

Successful exploitation could allow an attacker to read arbitrary files on the server hosting the COCO Annotator application by traversing directories via the vulnerable 'folder' parameter. This may lead to unauthorized disclosure of sensitive information. There is no indication of privilege escalation, denial of service, or code execution from the available data. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the affected endpoint, applying network-level controls to limit exposure, or using application-layer protections such as input validation or web application firewalls to mitigate path traversal attempts until a patch is released.