Smart Slider 3 < 3.5.1.37 - Admin+ Path Traversal to Arbitrary File Read via HTML Export

Description

The plugin is vulnerable to Path Traversal via the `replaceHTMLImage` function, which processes the `src` and `srcset` attributes during HTML export without sufficiently validating the supplied path. This makes it possible for authenticated attackers with administrator-level access and above to read the contents of arbitrary files on the server, which can contain sensitive information.