This vulnerability (CWE-22) in Themeum Kirki allows an editor with privileges to perform arbitrary file deletion via improper limitation of a pathname to a restricted directory (path traversal). It affects Kirki versions up to 6.0.13. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, no confidentiality or integrity impact, but high impact on availability. No known exploits are reported in the wild and no patch or official remediation level has been published.

An attacker with editor-level privileges can delete arbitrary files on the system, causing denial of service or loss of availability of critical files. There is no direct impact on confidentiality or integrity according to the CVSS vector. The availability impact is high due to potential arbitrary file deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor privileges to trusted users only and monitor for suspicious activity related to file deletions.