This vulnerability exists in the _read_events_tail function of the core/framework/server/routes_sessions.py file in adenhq hive up to version 0.11.0. It allows an unauthenticated remote attacker to perform path traversal by manipulating input to the Delete Request Handler, potentially accessing unauthorized files on the system. The vulnerability has been publicly disclosed with exploit information available, but the vendor has not issued any fix or advisory. The CVSS 4.0 base score is 6.9, reflecting network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

An attacker can remotely exploit this vulnerability to perform path traversal, potentially reading or affecting files outside the intended directory scope. This could lead to unauthorized information disclosure or other impacts depending on the files accessed. However, the impact is rated medium due to limited scope and no confirmed active exploitation in the wild.

No official patch or remediation is currently available from the vendor, who has not responded to the disclosure. Users should monitor the vendor's channels for any future updates. Until a fix is released, consider restricting network access to the affected service and applying any available compensating controls to limit exposure to untrusted users.