This vulnerability involves improper limitation of a pathname to a restricted directory (path traversal) in the VikBooking Hotel Booking Engine & PMS up to version 1.8.9. An attacker can exploit this flaw to access files outside intended directories, which may result in denial of service conditions. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. No vendor-provided patch or mitigation details are currently available, and the product is not a cloud service.

The vulnerability can be exploited remotely without authentication or user interaction to cause denial of service (availability impact) on affected VikBooking Hotel Booking Engine & PMS installations. There is no impact on confidentiality or integrity according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor vendor communications for updates. Until a patch is available, restricting external access to the affected application and applying standard network protections may help reduce exposure.