The vulnerability identified as CVE-2025-59002 affects SeaTheme BM Content Builder versions before 3.16.3.3. It is an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This allows an attacker with low privileges and no user interaction to cause a denial of service condition. The CVSS 3.1 base score is 7.7, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and a scope change with impact limited to availability.

An attacker with low privileges can exploit this vulnerability remotely to cause denial of service, impacting the availability of the affected system. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, monitor SeaTheme's advisories for updates. Until a fix is available, restrict access to the BM Content Builder interface to trusted users only and consider additional access controls to limit exploitation risk.