CVE-2024-35778 describes an improper limitation of a pathname to a restricted directory (CWE-22) in John West Slideshow SE, specifically in its PHP Local File Inclusion functionality. This flaw allows an attacker with low privileges to perform path traversal attacks to access files outside the intended directory scope. The vulnerability affects versions up to 2.5.17. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact. No patch or official remediation level has been published by the vendor as of the publication date.

An attacker with low privileges can exploit this vulnerability remotely to read sensitive files on the affected system, potentially exposing confidential information. There is no impact on data integrity or system availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable component to untrusted networks if possible.