This vulnerability (CWE-22) in Themeum Tutor LMS allows improper limitation of a pathname to a restricted directory, enabling path traversal attacks. It affects Tutor LMS versions up to 2.7.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with high privileges could exploit this path traversal vulnerability to read sensitive files outside the intended directory scope, potentially leading to unauthorized disclosure of confidential information. There is no indication of impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege user access and monitor for suspicious activity related to file access. Avoid exposing the affected versions in untrusted environments.