A directory traversal vulnerability exists in diffoscope versions before 327. This flaw allows an attacker to disclose contents of arbitrary files by exploiting embedded filenames in GPG files. The vulnerability arises because diffoscope trusts the value of the gpg --use-embedded-filenames option, enabling disclosure of sensitive files such as private SSH keys.