CVE-2024-46446 affects Mecha CMS version 3.0.0 and involves a directory traversal vulnerability (CWE-22). Attackers can manipulate cookies and URIs to circumvent user identity verification, then use POST parameters to delete arbitrary files or gain control over the website. The vulnerability has a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. No patch or official remediation has been provided as of the publication date.

Successful exploitation allows unauthenticated remote attackers to bypass authentication checks, delete arbitrary files on the server, and potentially take over the website. This results in a complete compromise of confidentiality and integrity of the affected system. Availability impact is not indicated. The vulnerability poses a critical risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Mecha CMS 3.0.0 installations, monitor for suspicious requests involving crafted cookies or URIs, and consider implementing web application firewall (WAF) rules to detect and block directory traversal patterns. Avoid exposing the CMS to untrusted networks if possible.