This vulnerability (CVE-2026-54193) in Fusion Builder (<= 3.15.4) arises from improper validation of file pathnames (CWE-22), enabling contributors to perform arbitrary file deletion via path traversal. The issue allows an attacker with contributor-level privileges to delete files outside intended directories, impacting system availability. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no user interaction, but requires some privileges. No patch or official remediation level has been provided yet, and no known exploits have been reported.

Successful exploitation results in arbitrary file deletion, which can cause denial of service or disruption of the affected system's availability. Confidentiality and integrity impacts are not indicated. The attacker must have contributor-level privileges, limiting the scope to users with some access. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor privileges where possible and monitor for suspicious file deletion activities related to Fusion Builder. Avoid granting contributor access to untrusted users.