This vulnerability in BoldGrid Total Upkeep involves improper limitation of a pathname to a restricted directory (CWE-22), enabling relative path traversal. This can allow an attacker to access files outside the intended directory scope, potentially exposing sensitive information. The affected versions include all versions up to 1.15.8. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. No official patch or vendor advisory detailing remediation is currently available.

Successful exploitation could allow an unauthenticated attacker to read arbitrary files on the system where BoldGrid Total Upkeep is installed, leading to potential exposure of sensitive data. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. Applying general access controls to limit exposure of the application and restricting file system permissions may reduce risk but are not guaranteed mitigations for this specific vulnerability.