CVE-2022-31508

CVE-2022-31508 is a critical absolute path traversal vulnerability affecting the idayrus/evoting repository before May 8, 2022, due to the unsafe use of Flask's send_file function. With a CVSS score of 9.3, this network-exploitable flaw allows an unauthenticated attacker to achieve high confidentiality impact and low availability impact with low attack complexity. While there is no known active exploitation or publicly available exploit code, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.