CVE-2026-66481: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Presto Player Presto Player Pro

CVE-2026-66481 is a CWE-22 path traversal vulnerability in Presto Player Pro (<= 3.0.1) that enables an authorized user with high privileges to delete arbitrary files on the system. The vulnerability arises from improper limitation of pathname to a restricted directory, allowing traversal outside intended directories. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges are high, no user interaction, and it impacts availability with no confidentiality or integrity impact.

An attacker with high privileges can exploit this vulnerability to delete arbitrary files, potentially causing denial of service or disruption of the affected system. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time.