This vulnerability involves improper limitation of pathname to a restricted directory (path traversal) in the QuickWebP plugin by Ludwig You, versions up to and including 3.2.7. An attacker with low privileges can exploit this flaw to access or modify files outside the intended directory scope, potentially leading to complete compromise of the affected system. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical severity with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. No official remediation or patch is currently documented, and the product is not a cloud service, so remediation depends on vendor patch release.

Successful exploitation can lead to full system compromise, including unauthorized disclosure, modification, or destruction of data due to path traversal outside restricted directories. The critical CVSS score indicates a severe impact on confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and limit privileges of users who can interact with it. Monitor for updates from Ludwig You and apply patches promptly once available.