This vulnerability (CVE-2025-10438) involves a path traversal issue (CWE-27) in Yordam Katalog prior to version 21.7. An attacker can manipulate file path inputs to access arbitrary files on the system by using directory traversal sequences such as 'dir/../../filename'. The CVSS 3.1 base score is 8.6, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and a confidentiality impact classified as high. Integrity and availability impacts are not affected. The vulnerability is publicly disclosed but no patch or remediation details are provided.

Successful exploitation could allow an unauthenticated remote attacker to read sensitive files on the affected system, potentially leading to disclosure of confidential information. There is no indication of impact on integrity or availability. The high CVSS score reflects the significant confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the affected application and validate or sanitize file path inputs if possible to mitigate exploitation.