A Path Traversal vulnerability in the VikBooking Hotel Booking Engine & PMS could allow an attacker to bypass directory restrictions and access sensitive files on the server.

The vulnerability is identified as an "Improper Limitation of a Pathname to a Restricted Directory" (Path Traversal). This allows an attacker to manipulate file paths to access unauthorized files, though the specific authentication requirement is not explicitly detailed.

With a CVSS score of 8.6, this vulnerability represents a high risk of sensitive data exposure, including configuration files, database credentials, or customer information. Successful exploitation could lead to full system compromise depending on the permissions of the web server process.

Immediate Action: Update the VikBooking plugin to the latest version provided by the vendor to remediate the directory traversal flaw.

Proactive Monitoring: Review web server logs for suspicious URL patterns containing directory traversal sequences such as "../".

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts targeting the application.

Public Exploit Available: false

Administrators must prioritize updating the VikBooking plugin immediately to mitigate the risk of unauthorized file access. Ensure that the web server process is running with the minimum necessary filesystem permissions to limit the potential impact of such vulnerabilities.