This vulnerability, identified as CWE-22, involves improper limitation of a pathname to a restricted directory in the Animated Number Counters product by Sk. Abul Hasan. It allows PHP local file inclusion via path traversal, which can be exploited remotely over the network with low complexity and no user interaction. The vulnerability impacts confidentiality but does not affect integrity or availability. Versions up to 1.9 are affected. No vendor advisory or patch information is currently provided.

An attacker with low privileges can exploit this vulnerability to include local files on the server, potentially disclosing sensitive information. The impact is limited to confidentiality, with no direct impact on integrity or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the application to untrusted users where possible.