The vulnerability CVE-2026-22448 in flexcubed PitchPrint is an improper limitation of a pathname to a restricted directory, commonly known as a path traversal flaw. This allows attackers to potentially access files outside the intended directory boundaries. The affected versions include all versions up to 11.1.2. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction. The impact is limited to availability, with no confidentiality or integrity impact noted. No patch or remediation information is currently available from the vendor or other sources.

The vulnerability can be exploited remotely without authentication or user interaction, potentially leading to denial of service or disruption of availability of the affected system. There is no reported impact on confidentiality or integrity. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, monitor vendor communications for updates. No specific mitigations are provided at this time.