This vulnerability (CVE-2026-27400) affects Ovatheme BookPro versions <=1.1.0 and is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). It enables unauthenticated attackers to delete arbitrary files on the system by exploiting a path traversal flaw. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with high impact on availability but no impact on confidentiality or integrity. No known exploits in the wild or vendor patches are currently reported.

The vulnerability allows unauthenticated remote attackers to delete arbitrary files on affected systems, potentially leading to denial of service or loss of critical data. There is no impact on confidentiality or integrity, but availability is severely affected. This can disrupt normal operation of the BookPro application and potentially the underlying system depending on file targets.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected application and monitor for suspicious activity. Avoid exposing the vulnerable version publicly. No official or temporary fixes are currently documented.