The gyoridavid short-video-maker application up to version 1.3.4 contains a path traversal vulnerability in its REST API implementation. The issue arises from improper validation or sanitization of the req.params.tmpFile parameter in the src/server/routers/rest.ts file, allowing remote attackers to traverse directories and access files outside the intended scope. This vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 6.9 (medium severity). The vulnerability was responsibly disclosed but remains unpatched as of the latest information. No vendor advisory or patch links are available, and the project has not responded to the report.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server hosting the gyoridavid short-video-maker application. This could lead to unauthorized disclosure of sensitive information. The vulnerability is remotely exploitable without any privileges or user interaction. However, there is no indication of privilege escalation, code execution, or other impacts beyond information disclosure. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. In the meantime, restricting external access to the REST API or implementing web application firewall (WAF) rules to detect and block path traversal attempts may reduce exposure. Avoid exposing the vulnerable API endpoint to untrusted networks until a fix is available.