A path traversal vulnerability exists in the Blocks module of Daylight Studio FuelCMS v1.5.2. The flaw allows an attacker to craft file path inputs that enable traversal outside the intended directory structure. This could potentially result in the application accessing files that it should not be able to read, thereby risking disclosure of sensitive data that resides on the web server's file system.

The affected software is Daylight Studio FuelCMS version 1.5.2, limited to the Blocks module. No other vendors or products are identified as impacted in the provided data.

The CVSS score of 4.3 categorizes the vulnerability as low severity. The EPSS score is below 1% (0.0006), indicating a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, achieved by sending crafted HTTP requests to the Blocks module endpoint that include a manipulated path parameter. No additional privileges or conditions are mentioned, suggesting exploitation would be straightforward once the target is reachable.