This vulnerability, identified as CVE-2026-27400, is a path traversal flaw in Ovatheme BookPro (<= 1.1.0) that permits unauthenticated attackers to delete arbitrary files. The issue arises from insufficient validation of file path inputs, enabling attackers to escape restricted directories and delete files outside intended boundaries. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, no confidentiality or integrity impact, but high availability impact.

Successful exploitation results in arbitrary file deletion without authentication, leading to potential denial of service or loss of critical files. The vulnerability does not impact confidentiality or integrity but severely affects availability of the system or data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor Ovatheme's advisories for updates and apply patches once available.