This vulnerability exists in the FileOperationsManager function of the hexstrike_server.py file within the API Files Endpoint component of 0x4m4 HexStrike AI. By manipulating the filename argument, an attacker can perform path traversal attacks remotely, potentially accessing files outside the intended directory scope. The vulnerability affects versions up to commit d689933ff579d839c676c82b231f8e98326c5f04. The project has been notified but has not issued a fix or response. The CVSS 4.0 vector indicates network attack vector with low complexity and no privileges or user interaction required, with limited confidentiality, integrity, availability, and security control impacts. Exploit code has been publicly disclosed.

An attacker can remotely exploit this vulnerability to perform path traversal, potentially reading or manipulating files outside the intended directory. This could lead to unauthorized access to sensitive information or disruption of service depending on the files accessed. The impact is rated medium severity with a CVSS score of 6.9, reflecting limited but meaningful confidentiality, integrity, and availability impacts.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a patch is released, restricting network access to the affected API Files Endpoint and applying compensating controls to validate and sanitize filename inputs may reduce risk.