The vulnerability in decap-server involves a path traversal issue due to the local proxy containment guard relying on plain string prefix comparison without proper path separator validation. This improper limitation allows attackers to bypass directory restrictions by accessing sibling directories whose names begin with the repository directory name. Consequently, attackers can perform unauthorized file operations such as reading, writing, or deleting files outside the intended repository root directory.

Successful exploitation can lead to unauthorized access to files outside the intended repository root, including reading, modifying, or deleting files in sibling directories. This can compromise data confidentiality and integrity within the affected system. The CVSS 4.0 base score of 7.6 reflects a high severity with network attack vector, high complexity, and partial user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the decap-server environment and monitor for suspicious activity related to file access. Avoid exposing the service to untrusted networks where possible.