The gioni Plugin Inspector plugin up to version 1.5 suffers from a path traversal vulnerability (CVE-2025-53298) due to improper restriction of pathnames to a designated directory. This allows an attacker with high privileges to read files outside the restricted directory boundaries. The CVSS 3.1 base score is 4.9 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with high privileges can exploit this vulnerability to read sensitive files outside the intended directory, potentially leading to unauthorized disclosure of confidential information. There is no impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Plugin Inspector plugin to trusted users only and monitor for suspicious activity related to file access. Avoid exposing the plugin to untrusted networks or users.