The vulnerability CVE-2024-52498 affects softpulseinfotech's SP Blog Designer up to version 1.0.0. It involves a path traversal flaw using the sequence '.../...//' that enables PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary local files on the server, potentially leading to full compromise of the application and underlying system. The attack vector is network-based, requiring low privileges and no user interaction, but the attack complexity is high. The CVSS 3.1 base score is 7.5, reflecting the significant impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in disclosure of sensitive files, modification of application data, and disruption of service. The attacker may gain the ability to execute arbitrary code or commands on the server hosting the vulnerable application, leading to a full system compromise. The high CVSS score reflects these critical impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable application, applying web application firewall rules to detect and block path traversal attempts, and monitoring for suspicious activity related to file inclusion attempts. Avoid exposing the application to untrusted networks if possible.