The vulnerability identified as CVE-2026-24969 affects designingmedia Instant VA (versions up to 1.0.1) and involves improper limitation of a pathname to a restricted directory, commonly known as a path traversal issue. This allows an attacker with low privileges to manipulate file paths to access or affect directories outside the intended scope, leading to a potential denial of service condition. The CVSS v3.1 score is 7.7 (high severity) with network attack vector, low attack complexity, requiring privileges, no user interaction, and a scope change. The impact is limited to availability, with no confidentiality or integrity loss reported. No patch or official remediation information is currently available.

The vulnerability can be exploited remotely by an attacker with some privileges to cause denial of service, impacting the availability of the Instant VA product. There is no evidence of confidentiality or integrity compromise. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected Instant VA versions and monitor for unusual activity related to file path handling. Avoid exposing the vulnerable service to untrusted networks if possible.