The efreja Music Sheet Viewer contains an improper limitation of a pathname to a restricted directory, classified as a path traversal vulnerability (CVE-2025-25155). This vulnerability affects versions up to 4.1 and allows an attacker to read files outside the intended directory scope by crafting malicious pathnames. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact but no integrity or availability impact. No patch or official remediation information is currently available.

Successful exploitation could allow an attacker to read sensitive files on the system that are outside the intended directory restrictions, potentially leading to disclosure of confidential information. There is no indication of integrity or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable application and monitor for suspicious activity related to file access. Avoid exposing the application to untrusted networks if possible.