This vulnerability exists in the _read_events_tail function of the core/framework/server/routes_sessions.py file in adenhq hive up to version 0.11.0. By manipulating input to this function, an attacker can perform path traversal, potentially accessing files outside the intended directory. The vulnerability can be triggered remotely without authentication. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. The vendor has not issued a patch or official fix, and no remediation level is provided.

Successful exploitation could allow an attacker to read arbitrary files on the affected system by traversing directories outside the intended scope. This could lead to unauthorized disclosure of sensitive information. However, the impact is rated medium due to the limited scope and the low integrity and availability impact indicated by the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as restricting access to the vulnerable component, applying input validation or filtering to prevent path traversal characters, and monitoring for suspicious activity related to file access. Stay alert for any future vendor advisories or patches.