CVE-2025-25122 describes a path traversal vulnerability in hashshop WizShop versions up to 3.0.2. The issue arises from improper handling of the path sequence '.../...//', enabling attackers to traverse directories outside the intended scope. This can allow unauthorized reading or modification of files, impacting confidentiality, integrity, and availability. The vulnerability is remotely exploitable without privileges or user interaction but requires high attack complexity. No vendor patch or advisory is currently available.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files and data on the affected system, potentially allowing attackers to read, modify, or delete files. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected WizShop versions and monitor for suspicious activity related to path traversal attempts. Avoid exposing the affected application to untrusted networks if possible.