The Apptha Slider Gallery plugin (appthaplugins) suffers from an improper limitation of a pathname to a restricted directory, known as a path traversal vulnerability (CVE-2025-31050). This vulnerability allows remote attackers to read arbitrary files on the affected system by crafting malicious requests that traverse directories beyond the intended scope. The issue affects all versions up to and including 2.5. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive files on the server hosting the Apptha Slider Gallery plugin. This can compromise confidentiality but does not affect integrity or availability. Since no privileges or user interaction are required, the risk is significant for exposed installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin or implementing web application firewall rules to block path traversal attempts targeting this component.