The vulnerability exists in OctoPrint 1.0.0 within the _validate function of src/octoprint/server/api/files.py, part of the File Download API. By manipulating the filename parameter, an attacker can perform a path traversal attack remotely, potentially accessing files outside the intended directory. The vendor was contacted but did not respond, and no official patch or remediation is currently available. A public exploit is known.

An attacker can remotely exploit this vulnerability to perform path traversal, potentially accessing sensitive files on the affected system. This could lead to unauthorized disclosure of information. The CVSS 4.0 score is 5.3 (medium severity), indicating a moderate impact with no required privileges and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider restricting access to the affected API and monitor for exploit attempts. Avoid exposing the vulnerable API to untrusted networks until a fix is released.