This vulnerability (CVE-2026-66695) involves an unauthenticated path traversal issue in W3 Total Cache versions <= 2.10.2. The flaw is categorized under CWE-35 and allows attackers to manipulate file paths using sequences such as '.../...//', which may enable unauthorized access to files or resources outside the intended directory. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, but limited integrity and availability impacts.

An attacker can exploit this vulnerability remotely without authentication to perform path traversal attacks. This may lead to limited integrity and availability impacts, such as unauthorized modification or disruption of files accessible to the application. Confidentiality is not impacted according to the CVSS vector. No known active exploitation has been reported.

No official patch or remediation level has been disclosed by the vendor as of the publication date. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor official BoldGrid communications for updates and consider applying any recommended temporary mitigations if provided.