This vulnerability (CWE-22) in Automattic Newspack Blocks involves improper limitation of pathname inputs, enabling path traversal attacks. It affects versions up to 3.0.8 and allows an attacker with low privileges to bypass directory restrictions. The CVSS 3.1 score of 8.5 indicates network attack vector, low attack complexity, privileges required, no user interaction, scope changed, no confidentiality impact, limited integrity impact, and high availability impact. No vendor advisory or patch is currently available, and the product is not a cloud service.

An attacker with low privileges can exploit this vulnerability to perform path traversal, potentially modifying files outside intended directories. This can lead to integrity loss and denial of service conditions. Confidentiality is not impacted according to the CVSS vector. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Newspack Blocks plugin and monitor for unusual file system activity related to the application. Avoid exposing the affected versions in untrusted environments.