The Link Library WordPress plugin versions prior to 7.9.6 do not properly sanitize user-supplied input specifying the destination folder for generated images. This improper limitation of pathname (CWE-22) enables authenticated users with Contributor or higher privileges to create directories and write or overwrite image files anywhere the web server has write permissions, potentially outside the site's document root. The vulnerability does not allow planting executable code because the filenames are numeric and have fixed image extensions. The CVSS v3.1 base score is 4.1, reflecting a medium severity with network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker with Contributor or higher privileges can write or overwrite image files in arbitrary writable locations on the server, including outside the web root. This could lead to limited integrity impact by replacing or adding image files, but does not allow direct code execution or confidentiality compromise. The scope is changed, indicating the vulnerability affects resources beyond the original security scope.

A fixed version 7.9.6 of the Link Library plugin addresses this vulnerability by properly sanitizing the destination folder input. Users should upgrade to version 7.9.6 or later to remediate this issue. No other mitigation guidance is provided or necessary as the vulnerability is fixed in the updated plugin version.