The vulnerability is located in the FileManager::isEditable method of the Admin File Manager component of Croogo CMS versions up to 4.0.7. The flaw allows an attacker to supply a crafted file path that bypasses directory restrictions in this method, resulting in a path traversal weakness (CWE‑22). This can be used to read files located outside the intended directory hierarchy, thereby compromising the confidentiality of data stored on the web server. The description does not indicate that the flaw permits remote file writes or code execution; the primary impact is the unauthorized reading of arbitrary files.

Croogo CMS versions 4.0.7 and earlier are affected. The vulnerable component is the Admin File Manager, specifically the FileManager::isEditable endpoint. No later versions are identified as affected by the current advisory.

The CVSS base score of 5.3 reflects a moderate severity. An EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, publicly available exploit code demonstrates that the issue can be triggered remotely by sending a crafted request to the isEditable endpoint. The attack vector is network‑based; an external attacker must have network access to the CMS instance and ability to submit HTTP requests to the vulnerable endpoint.