CVE-2026-40805

Summary

The flaw allows authenticated subscribers to delete arbitrary files on the server by manipulating file paths in PeepSo plugin versions up to 9.0.5.4, potentially leading to service disruption or data loss.

Exploitability

Exploitation requires an authenticated subscriber account with access to the PeepSo plugin, and is relatively straightforward once the attacker has credentials.

Blast radius

If exploited, this vulnerability could lead to deletion of critical application files, user uploads, or configuration data, causing service degradation or complete system unavailability.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to PeepSo version 9.0.5.5 or later to remediate this arbitrary file deletion vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.