CVE-2026-72569 is a critical path traversal vulnerability in cube-root/directory-serve up to version 1.3.7. When the application is executed with the --delete option enabled, an unauthenticated remote attacker can exploit this flaw to delete arbitrary files outside the intended served directory. The vulnerability is identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS v3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity and availability. No patch or official fix information is currently provided, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated attacker to delete arbitrary files on the system outside the intended directory, potentially causing significant data loss or service disruption. The integrity and availability of the affected system can be severely impacted. Confidentiality is not affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running cube-root/directory-serve with the --delete option enabled, or restrict access to trusted users only. Monitor vendor channels for updates or patches addressing this vulnerability.