The vulnerability CVE-2025-54021 affects Mitchell Bennis Simple File List (up to version 6.1.14) and involves improper limitation of a pathname to a restricted directory, commonly known as a path traversal issue. This allows an attacker to craft requests that access files outside the designated directory, potentially exposing sensitive information. The CVSS 3.1 base score is 7.5, reflecting high severity due to its network accessibility and lack of required privileges or user interaction. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an unauthenticated attacker to read arbitrary files on the server hosting Simple File List, potentially exposing sensitive data. The vulnerability does not impact integrity or availability according to the CVSS vector, but confidentiality is rated high impact. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for unusual file access patterns. Avoid exposing the application to untrusted networks if possible.