The vulnerability identified as CVE-2025-10449 involves improper limitation of a pathname to a restricted directory (CWE-22) in the Saysis Web Portal product. Affected versions include 3.1.9 and 3.2.0 prior to 3.2.1. This flaw allows remote attackers to perform path traversal attacks, potentially accessing sensitive files outside intended directories. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without affecting integrity or availability.

Successful exploitation could allow an unauthenticated attacker to read sensitive files on the server by traversing directories outside of the intended restricted path. This compromises confidentiality but does not affect integrity or availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor Saysis Computer Systems Trade Ltd. Co. communications for updates. Until a fix is available, consider restricting access to the web portal and applying compensating controls such as web application firewalls to detect and block path traversal attempts.