The vulnerability CVE-2026-28078 in Stylemix uListing (versions up to 2.2.0) is a path traversal issue caused by improper restriction of pathnames to a limited directory. This allows an attacker with high privileges to traverse directories and access files beyond the intended scope. The CVSS score is 4.9 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or remediation information is provided in the available data.

An attacker with high privileges could exploit this vulnerability to read sensitive files outside the restricted directory, potentially leading to confidentiality breaches. There is no reported impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected versions and limit user privileges to reduce risk.