The vulnerability CVE-2025-30594 affects samsk Include URL versions up to 0.3.5 and is classified as a path traversal issue. It arises from improper restriction of pathnames, enabling an attacker with low privileges to read files outside the designated directory. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high confidentiality impact. No official patch or remediation guidance is currently documented.

Successful exploitation could allow an attacker with low privileges to read sensitive files outside the intended directory, leading to confidentiality breaches. There is no impact on integrity or availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable component and monitor for suspicious activity related to path traversal attempts. Avoid exposing the Include URL functionality to untrusted users if possible.