CVE-2026-61980 is a path traversal vulnerability (CWE-22) in OMGF Pro by Daan.dev, allowing unauthenticated attackers to download arbitrary files from the server. The flaw exists in versions up to 5.2.7, where the application fails to properly restrict pathname inputs to a safe directory, enabling access to files outside the intended scope. The vulnerability has a CVSS 3.1 base score of 7.5 (High), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality with no integrity or availability impact. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can exploit this vulnerability to download arbitrary files from the OMGF Pro server, potentially exposing sensitive information. The impact is limited to confidentiality as there is no indication of integrity or availability compromise. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and monitor for suspicious activity related to file downloads.