The vulnerability CVE-2025-60217 affects ypromo PT Luxa Addons up to version 1.2.2. It is an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This allows an attacker with low privileges (PR:L) and no user interaction (UI:N) to cause a denial of service (availability impact) by accessing or manipulating files outside intended directories. The CVSS v3.1 base score is 7.7 (high severity), with network attack vector and low attack complexity. No confidentiality or integrity impact is indicated.

The impact is limited to availability, meaning the vulnerability could be exploited to disrupt service or cause denial of service conditions. There is no direct impact on confidentiality or integrity of data. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to the affected component and limiting privileges may reduce risk.