This vulnerability (CVE-2026-59548) affects Byteflows Travel & Hotel Booking software versions up to 1.0.0 and involves unauthenticated exposure of sensitive system information, classified under CWE-497. The vulnerability can be exploited remotely without authentication or user interaction, resulting in high confidentiality impact but no integrity or availability impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to access sensitive system information from the affected Byteflows Travel & Hotel Booking application, potentially leading to information disclosure that could aid further attacks. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application where possible and monitor for unusual access patterns. Avoid exposing the application to untrusted networks if feasible.