This vulnerability in Kilo-Org kilocode (versions up to 7.0.47) involves the Bun.file function within the file packages/opencode/src/kilocode/review/worktree-diff.ts, specifically in the File Diff API Endpoint. By manipulating the file argument, an attacker can perform a path traversal attack remotely. This could potentially allow unauthorized access to files outside the intended directory scope. The vulnerability is publicly disclosed with no vendor response or patch available at this time.

The impact of this vulnerability is that an attacker can remotely exploit the path traversal flaw to access files outside the intended directory structure via the File Diff API Endpoint. This could lead to unauthorized information disclosure. The CVSS score of 5.3 indicates a medium severity impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as restricting access to the vulnerable API endpoint, applying network-level controls to limit exposure, or using web application firewalls to detect and block path traversal attempts until a vendor patch is released.