This vulnerability in Bagisto v2.4.1 involves improper limitation of a pathname to a restricted directory (CWE-22) in the ImageCacheController. An attacker can send specially crafted requests with path traversal sequences in the filename parameter to access files beyond the intended directory scope without authentication. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality.

An unauthenticated attacker can read arbitrary sensitive files on the targeted system by exploiting this path traversal vulnerability. This can lead to disclosure of confidential information, potentially compromising system security or privacy depending on the files accessed.

Patch status is not yet confirmed — no official fix or remediation level has been provided by the vendor Webkul. Users should monitor the vendor advisory for updates and apply any forthcoming patches promptly. Until a fix is available, consider implementing web application firewall (WAF) rules to detect and block path traversal attempts targeting the filename parameter in ImageCacheController.