The vulnerability CVE-2025-30596 affects the tstafford include-file product, allowing path traversal attacks by improperly restricting pathname access to directories. This can lead to unauthorized reading of files outside the intended directory scope. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The affected versions include version 0 and earlier through 1. No patch or mitigation details are currently provided.

An attacker with low privileges can exploit this vulnerability remotely to read sensitive files outside the restricted directory, potentially exposing confidential information. The integrity and availability of the system are not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the vulnerable component and monitor for suspicious activity related to path traversal attempts. Avoid exposing the include-file service to untrusted networks if possible.