The vulnerability identified as CVE-2025-31825 in pixelgrade Category Icon is an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This allows an attacker with high privileges to potentially read sensitive files outside the intended directory scope. The affected product versions are from initial releases through 1.0.1. The CVSS v3.1 base score is 4.9, reflecting medium severity with network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official remediation information is currently available, and no exploits in the wild have been reported.

An attacker with high privileges can exploit this vulnerability to read sensitive files outside the restricted directory, potentially exposing confidential information. There is no reported impact on integrity or availability. The medium severity score reflects the confidentiality risk posed by this path traversal flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected product to trusted users only and monitor for unusual file access patterns related to path traversal attempts.