This vulnerability in Aeroscroll Gallery versions up to 1.0.13 involves improper validation of file paths, enabling path traversal via '.../...//' sequences. An attacker can potentially read files outside the intended directory scope by manipulating input paths. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges or user interaction required, and high confidentiality impact but no integrity or availability impact. No patch or official remediation details are currently available.

Successful exploitation could allow an attacker to read sensitive files on the server hosting the Aeroscroll Gallery plugin, potentially exposing confidential information. There is no indication of integrity or availability impact. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting access to the affected plugin or implementing web server rules to block suspicious path traversal patterns. Monitor vendor channels for updates on official fixes.