The vulnerability arises from improper handling of file paths in JSON requests, allowing an attacker to manipulate the file path and delete arbitrary files on the server. This includes critical configuration files such as config.json and ds_config_chatbot.json. The ability to traverse directories and delete any JSON file can lead to significant disruption, unauthorized access, and potential data loss or corruption.

An attacker intercepts a request to delete a conversation title and modifies the file path in the request to point to a critical JSON file, such as config.json. By sending the modified request, the attacker can delete the specified file. Additionally, the attacker can traverse directories to identify and delete any JSON file on the server, leading to unauthorized access and manipulation of sensitive information.

Users of the affected software version 20240410 are vulnerable. This includes any server running this version where users have the ability to send JSON requests that can be intercepted and modified.