This vulnerability (CVE-2026-95588) in AcyMailing SMTP Newsletter (<= 11.0.5) is a path traversal issue that enables unauthenticated attackers to delete arbitrary files on the affected system. The flaw arises from improper limitation of pathnames to restricted directories, allowing attackers to specify file paths outside intended directories. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low complexity, no privileges required, no user interaction, and a scope change with high impact on availability but no impact on confidentiality or integrity.

Successful exploitation results in arbitrary file deletion on the targeted system, potentially disrupting service availability. There is no direct impact on confidentiality or integrity according to the CVSS vector. The vulnerability can be exploited remotely without authentication, increasing the risk of widespread impact.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to file operations.