This vulnerability (CVE-2026-56066) in ShortPixel Adaptive Images (versions up to 3.11.4) is classified as CWE-22, an improper limitation of a pathname to a restricted directory, commonly known as a path traversal issue. It enables unauthenticated attackers to delete arbitrary files on the affected system, impacting availability. The CVSS 3.1 base score is 5.8 (medium), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. No vendor advisory or patch information is currently available, and the vulnerability is not known to be exploited in the wild.

The vulnerability allows unauthenticated attackers to delete arbitrary files on the system running ShortPixel Adaptive Images up to version 3.11.4. This impacts system availability by potentially removing critical files. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected application and monitor for suspicious activity related to file deletions. Avoid exposing the service to untrusted networks if possible.