The vulnerability CVE-2025-30882 affects JoomSky JS Help Desk versions up to 2.9.1. It is an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This flaw allows remote attackers to access files outside the intended directory by manipulating file path inputs. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality but not integrity or availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to read arbitrary files on the affected system, potentially exposing sensitive information. There is no indication that the vulnerability allows modification or disruption of service. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.