CVE-2026-78284: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Stylemix MasterStudy LMS

This vulnerability, identified as CWE-22 (Path Traversal), affects MasterStudy LMS versions <= 3.7.42. It permits unauthenticated attackers to delete arbitrary files by exploiting insufficient validation of file path inputs, bypassing directory restrictions. The CVSS v3.1 score is 8.6, reflecting network attack vector, low complexity, no privileges required, no user interaction, and a scope change with high impact on availability but no confidentiality or integrity impact. No official patch or remediation guidance is currently provided by the vendor or advisory sources.

Successful exploitation results in arbitrary file deletion without authentication, impacting system availability and potentially disrupting LMS operations. There is no direct impact on confidentiality or integrity reported. The vulnerability's high CVSS score indicates a significant risk of denial of service or operational disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the LMS server and monitor for suspicious activity related to file operations. Avoid exposing the LMS to untrusted networks without additional protective controls.