CVE-2026-54193 is a CWE-22 path traversal vulnerability in Fusion Builder versions <= 3.15.4. It permits users with contributor-level access to perform arbitrary file deletion by exploiting improper limitation of pathnames to restricted directories. The vulnerability has a CVSS 3.1 base score of 7.7, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and a scope change with high impact on availability only.

The vulnerability allows an attacker with contributor privileges to delete arbitrary files on the affected system, resulting in denial of service conditions. There is no impact on confidentiality or integrity according to the CVSS vector. This could disrupt website functionality or cause data loss related to the deleted files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor privileges and monitor for suspicious activity related to file deletions. Avoid granting contributor access to untrusted users.