CVE-2025-26753 describes an improper limitation of a pathname to a restricted directory (path traversal) vulnerability in videowhisper Broadcast Live Video (versions up to 6.2). This flaw allows remote attackers to access files outside intended directories by crafting malicious pathnames. The vulnerability is remotely exploitable without authentication or user interaction, impacting confidentiality but not integrity or availability. No patch or official fix details are currently provided.

Successful exploitation could allow an unauthenticated remote attacker to read sensitive files outside the intended directory structure, potentially exposing confidential information. The vulnerability does not affect integrity or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected application and monitor for unusual file access patterns. Avoid exposing the vulnerable service to untrusted networks if possible.