The ARForms plugin by reputeinfosystems contains a path traversal vulnerability identified as CVE-2024-54216. This issue arises from improper handling of path input sequences such as '.../...//', enabling an attacker with low privileges to read arbitrary files on the affected system. The vulnerability affects all versions up to 6.4.1. The CVSS v3.1 base score is 7.7, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without affecting integrity or availability.

Successful exploitation of this vulnerability could allow an attacker with low privileges to read sensitive files outside the intended directory structure, potentially exposing confidential information. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the ARForms plugin and monitor for suspicious activity related to path traversal attempts. Avoid exposing the plugin to untrusted users where possible.