The vulnerability CVE-2025-47513 affects James Laforge Infocob CRM Forms through version 2.4.0 and is classified as an improper limitation of a pathname to a restricted directory (path traversal). This allows an attacker with high privileges to read files outside the intended directory boundaries. The CVSS 3.1 base score is 4.9 (medium), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impact limited to confidentiality. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An attacker with high privileges can exploit this vulnerability to read sensitive files outside the restricted directories, leading to unauthorized information disclosure. There is no impact on integrity or availability. The vulnerability requires high privileges, limiting the attack surface to users who already have significant access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and monitor for suspicious activity related to file access. Do not assume the vulnerability is mitigated without vendor confirmation.