CVE-2026-30462 describes a path traversal vulnerability (CWE-22) in the Blocks module of Daylight Studio FuelCMS version 1.5.2. This vulnerability enables attackers with low privileges to execute directory traversal attacks, potentially accessing files outside the intended directory scope. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges but no user interaction, and impacts confidentiality with no impact on integrity or availability. No patch or official remediation level has been published as of the data provided.

The vulnerability allows an attacker with limited privileges to perform directory traversal, which may lead to unauthorized access to files on the server. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Blocks module to trusted users and monitor for suspicious activity related to directory traversal attempts.