This vulnerability (CVE-2026-73383) affects WebAppick CTX Feed versions up to 6.6.47 and involves an improper limitation of a pathname to a restricted directory (CWE-22). It allows a user with shop manager privileges to download arbitrary files from the system by exploiting a path traversal flaw. The CVSS v3.1 base score is 4.9, reflecting a network attack vector with low complexity but requiring high privileges and no user interaction. Confidentiality impact is high, while integrity and availability impacts are none. No known exploits are reported in the wild, and no vendor remediation or patch has been documented yet.

An attacker with shop manager privileges can exploit this vulnerability to download arbitrary files from the server, potentially exposing sensitive information. The confidentiality impact is high, but the vulnerability does not affect integrity or availability. Exploitation requires high privileges, limiting the attack surface to authorized shop managers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict shop manager privileges to trusted users only and monitor for suspicious activity related to file access. No official patch or temporary fix is currently documented.