This vulnerability in WorkScout-Core (<=1.7.11) is caused by improper limitation of a pathname to a restricted directory (CWE-22), enabling unauthenticated attackers to delete arbitrary files. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but low integrity and high availability impact. No official patch or remediation level is currently documented, and no known exploits in the wild have been reported.

An attacker can delete arbitrary files on the affected system without authentication, impacting the integrity and availability of the system. There is no confidentiality impact reported. This could disrupt normal operations or cause denial of service by removing critical files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to file operations. Avoid exposing the vulnerable version to untrusted networks.