This vulnerability in CodeAstro Online Job Portal 1.0 involves an unknown functionality related to the /users/user-cvs/ file or directory, which can be manipulated remotely to expose file and directory information. The CVSS 4.0 base score is 6.9 (medium), reflecting network attack vector, no privileges required, no user interaction, and low complexity. The vulnerability allows attackers to gain information about files and directories that should not be publicly accessible, potentially aiding further attacks. No official patch or remediation level has been provided by the vendor or authoritative sources as of the published date.

The impact is limited to information exposure of files and directories under /users/user-cvs/. This could allow attackers to gather sensitive information about user CVs or related data stored in that path. There is no indication of code execution, privilege escalation, or data modification. The exposure could facilitate further targeted attacks or privacy violations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /users/user-cvs/ directory through web server configuration or access controls to prevent unauthorized remote access. Monitor for any updates from CodeAstro regarding patches or mitigations.