This vulnerability (CVE-2026-57331) involves improper limitation of a pathname to a restricted directory (CWE-22) in the videowhisper Paid Videochat Turnkey Site product. Specifically, performers can exploit this flaw to delete arbitrary files on the server, potentially leading to complete compromise of the system's confidentiality, integrity, and availability. The affected versions are all versions up to and including 7.4.8. The vulnerability is remotely exploitable with low attack complexity and requires limited privileges but no user interaction. The vendor has not provided an official fix or advisory at this time.

Successful exploitation allows an authenticated performer to delete arbitrary files on the server, which can lead to data loss, service disruption, and potential full system compromise. The CVSS 3.1 base score of 9.9 reflects critical impact across confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict performer privileges and monitor for suspicious activity related to file operations. Avoid exposing the vulnerable application to untrusted networks where possible.