This vulnerability (CVE-2026-57321) involves improper limitation of a pathname to a restricted directory (CWE-22) in H5P versions up to 1.17.7. It enables contributors to delete arbitrary files, potentially disrupting system availability and integrity. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and requires only low privileges (PR:L). No user interaction is needed, and the scope is unchanged. The vendor has not provided an official fix or remediation level at this time.

The vulnerability allows an attacker with contributor-level privileges to delete arbitrary files, leading to integrity loss and high impact on availability. This can disrupt normal operations of the affected system or application. There is no indication of confidentiality impact. No known exploits are reported in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor privileges where possible and monitor for suspicious file deletion activities related to H5P. Avoid granting unnecessary write or delete permissions to contributor roles.