The vulnerability CVE-2026-57389 in Adrian Tobey Groundhogg is a path traversal flaw that allows an attacker to bypass directory restrictions by manipulating pathnames. This can lead to unauthorized access to files outside the intended directory scope. The issue affects Groundhogg versions up to 4.4.1. According to the CVSS 3.1 vector, the attack can be performed remotely (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The scope is changed (S:C), impacting availability (A:H) but not confidentiality or integrity. There is no vendor advisory or patch information available at this time.

The vulnerability allows an unauthenticated remote attacker to perform path traversal attacks, potentially causing denial of service or disruption of availability of the affected system. There is no direct impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor for updates from the vendor Adrian Tobey regarding Groundhogg. No specific mitigation steps are provided in the available data.