The ctltwp Section Widget up to version 3.3.1 contains a path traversal vulnerability identified as CVE-2025-46441. This vulnerability arises from improper handling of path input containing '.../...//' sequences, enabling an attacker to traverse directories outside the intended scope. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. No official patch or remediation details have been provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to read files outside the intended directory structure, potentially exposing sensitive information. However, the impact is limited to confidentiality with no direct impact on integrity or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No vendor advisory or patch links are currently provided.