Bit Apps Bit Form Pro versions up to 2.6.4 suffer from a CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. This allows an unauthenticated remote attacker to manipulate file paths, potentially leading to unauthorized file manipulation. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with high impact on availability but no confidentiality or integrity impact. No patch or official remediation level has been published by the vendor as of the data provided.

The vulnerability can be exploited remotely without authentication or user interaction, potentially causing denial of service by disrupting the availability of the affected system. There is no direct impact on confidentiality or integrity according to the CVSS vector. No known active exploits have been reported, but the high CVSS score indicates a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and monitor for unusual file system activity related to Bit Form Pro. Avoid exposing the application to untrusted networks if possible.