The vulnerability CVE-2025-49303 involves improper limitation of a pathname to a restricted directory (path traversal) in the acf-frontend-form-element component of Frontend Admin by DynamiApps. This flaw affects versions up to 3.28.7 and allows an attacker with high privileges to bypass directory restrictions, potentially accessing sensitive files. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and high confidentiality impact with no integrity or availability impact.

An attacker with high privileges can exploit this vulnerability to access restricted directories and read sensitive files, potentially leading to unauthorized disclosure of confidential information. There is no indication of integrity or availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected component to trusted administrators only and monitor for suspicious activity related to path traversal attempts.