The vulnerability CVE-2025-22663 involves improper limitation of a pathname to a restricted directory in the videowhisper Paid Videochat Turnkey Site, specifically the ppv-live-webcams component. This path traversal flaw allows an unauthenticated attacker to access files outside the intended directory structure. The affected product versions include all versions up to 7.2.12. The CVSS v3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, no confidentiality or integrity impact, but high impact on availability.

An attacker can exploit this vulnerability remotely without authentication to cause a high availability impact, potentially disrupting service or causing denial of service conditions. There is no direct impact on confidentiality or integrity according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Users should monitor vendor communications for updates and apply any official fixes once available.