The vulnerability CVE-2025-52237 affects SSCMS version 7.3.1 in the /stl/actions/download?filePath component, enabling directory traversal attacks. This allows an unauthenticated attacker to potentially read arbitrary files on the server by crafting malicious requests that traverse directories. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability. There is no known exploit in the wild and no vendor patch or advisory currently provided.

Successful exploitation could allow an attacker to read files outside the intended directory, potentially exposing sensitive information and affecting confidentiality and integrity of the system. There is no indication of availability impact. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable component and monitor for suspicious requests targeting the /stl/actions/download?filePath endpoint. Avoid exposing this functionality to untrusted networks if possible.