The vulnerability CVE-2025-49303 involves improper limitation of a pathname to a restricted directory (path traversal) in the Frontend Admin by DynamiApps product, affecting versions through 3.28.7. An attacker with high privileges can exploit this flaw to access files outside the intended directory scope, potentially leading to unauthorized disclosure of sensitive information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with high confidentiality impact but no integrity or availability impact.

Successful exploitation of this vulnerability could allow an attacker with high privileges to read sensitive files outside the intended directory, resulting in a confidentiality breach. There is no impact on system integrity or availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to trusted users only and monitor for any unusual access patterns related to directory traversal attempts. Avoid exposing vulnerable versions in untrusted environments.