CVE-2026-66476 is a path traversal vulnerability in Easy Digital Downloads (<= 3.6.9) that permits an administrator to delete arbitrary files on the system. The vulnerability arises from improper limitation of pathname to a restricted directory, enabling file deletion outside intended boundaries. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact.

An attacker with administrator privileges can delete arbitrary files, potentially causing denial of service or disruption of the application or system availability. There is no direct impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, restrict administrator access to trusted personnel only.