CVE-2022-4748

CVE-2022-4748 is a critical path traversal vulnerability affecting FlatPress, specifically within the doItemActions function of the fp-plugins/mediamanager/panels/panel.mediamanager.file.php file. This flaw allows an unauthenticated attacker to manipulate the 'deletefile' argument to traverse directories, potentially leading to arbitrary file deletion or other system compromise. With a CVSS score of 9.8, it presents a high risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While no active exploitation, public exploits, or significant community discussion have been observed, a patch (5d5c7f6d8f072d14926fc2c3a97cdd763802f170) is available and recommended for immediate application.