CVE-2025-27092

CVE-2025-27092 is a path traversal vulnerability in GHOSTS version 8.0.0.0, an open-source user simulation framework. An unauthenticated attacker can exploit the /api/npcs/{id}/photo endpoint by crafting a malicious photoLink value to access arbitrary files outside the intended directory. This high-severity vulnerability (CVSS 7.5) allows for unauthorized information disclosure, potentially exposing sensitive system files and credentials. There are no known active exploits, public exploit code, or significant community discussion, but users are advised to upgrade to version 8.2.7.90 immediately as no workarounds exist.