This vulnerability in Infility Infility Global (versions <= 2.15.06) involves improper limitation of pathnames to restricted directories, commonly known as a path traversal vulnerability. It allows an attacker with low privileges to potentially read files outside the intended directory scope by crafting malicious pathnames. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An attacker with low privileges can exploit this vulnerability to access sensitive files outside the intended directory, potentially leading to unauthorized disclosure of confidential information. There is no indication of integrity or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Infility's advisories for updates. In the meantime, restrict access to the affected versions and consider applying any available workarounds recommended by the vendor once published.