The vulnerability identified as CVE-2024-9146 involves improper limitation of a pathname to a restricted directory in the jamesdlow CSS JS Files product. This path traversal flaw enables an attacker with high privileges to potentially read sensitive files outside the designated directory. The issue affects versions up to 1.5.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.

An attacker with high privileges can exploit this vulnerability to read sensitive files outside the intended directory, potentially leading to unauthorized disclosure of confidential information. There is no reported impact on integrity or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the affected software to trusted users with appropriate privileges to minimize risk.