This vulnerability involves improper directory listing in the baserCMS plugin for BurgerEditor and BurgerEditor Limited Edition before version 2.25.1. Remote attackers can exploit this issue to obtain sensitive information by viewing the list of uploaded files. The CVSS 3.1 vector indicates the attack is network-based, requires no privileges or user interaction, and impacts confidentiality only. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

The impact is limited to confidentiality as attackers can gain unauthorized access to the list of uploaded files, potentially revealing sensitive information. There is no impact on integrity or availability according to the CVSS vector. This exposure could aid further reconnaissance or targeted attacks but does not directly compromise system control or data modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to 2.25.1, upgrading to version 2.25.1 or later is recommended once a fix is confirmed. Until then, restrict access to the affected directories and review web server configurations to disable directory listing where possible.