This vulnerability in RTGS2017 NagaAgent (up to version 5.1.0) allows remote attackers to perform path traversal via manipulation of the 'Name' argument in the Skills Endpoint component (apiserver/routes/extensions.py). This can potentially allow unauthorized access to files outside the intended directory. The issue was reported early to the project but remains unpatched, and no official remediation guidance is available. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to read or access files outside the intended directory structure on the affected system remotely, potentially exposing sensitive information or configuration files. The impact is rated medium severity with limited confidentiality, integrity, and availability impact according to the CVSS 4.0 vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, organizations should monitor for official updates. In the meantime, consider implementing network-level restrictions to limit access to the vulnerable endpoint and apply any available compensating controls to reduce exposure.