This vulnerability exists in the unlink function of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php within the Logo Handler component of Faveo Helpdesk. By manipulating the argument data1, an attacker can perform path traversal, potentially leading to unauthorized file deletion or manipulation. The issue affects versions 2.0.0, 2.0.1, 2.0.2, and 2.0.3. The vulnerability can be exploited remotely without user interaction and requires high privileges. The vulnerability has been publicly disclosed, but the vendor has not yet provided a fix or official remediation guidance.

Successful exploitation allows remote attackers with high privileges to perform path traversal via the unlink function, potentially deleting or manipulating files outside the intended directory. This could lead to partial denial of service or unauthorized file system changes. The CVSS 4.0 score of 5.1 reflects a medium impact with limited scope and complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, restrict access to the affected functionality to trusted users only and consider applying compensating controls to limit exposure.