CVE-2025-39473 describes a path traversal vulnerability in WebGeniusLab Seofy Core versions up to 1.6.8. The vulnerability arises from improper restriction of pathnames, enabling an attacker to perform PHP Local File Inclusion. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is remotely exploitable over the network without privileges or user interaction but requires high attack complexity. There is no vendor advisory or patch information currently available, and no known active exploitation has been reported.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system, including unauthorized disclosure of sensitive information, modification or deletion of data, and disruption of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, exploitation requires a complex attack vector, and no active exploits are currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor WebGeniusLab communications for updates. Until a fix is available, restricting access to the affected application and applying strict input validation or web application firewall rules targeting path traversal attempts may help reduce risk.