A vulnerability, which was classified as critical, was found in 299ko up to 2.0.0. Affected by this issue is the function
getSentDir/delete of the file plugin/filemanager/controllers/FileManagerAPIController.php. Executing manipulation can lead to path traversal.
This vulnerability is registered as CVE-2025-10232. It is possible to launch the attack remotely. Furthermore, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
