Sabri Woolook versions up to 1.7.0 contain an improper limitation of a pathname to a restricted directory vulnerability, categorized as a path traversal issue. This flaw enables PHP Local File Inclusion, potentially allowing an attacker to include and execute arbitrary local files. The vulnerability has a CVSS 3.1 score of 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

Successful exploitation of this vulnerability can lead to local file inclusion, which may result in disclosure of sensitive information, modification of files, or denial of service. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and avoid exposing it to untrusted users. Monitor vendor channels for updates or patches addressing this vulnerability.