CVE-2026-78284

Received Received - Intake

Unauthenticated Arbitrary File Deletion in MasterStudy LMS

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Patchstack

Description

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-78284

Affected Vendors & Products

Vendor	Product	Version / Range
masterstudy	lms	to 3.7.42 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is an unauthenticated arbitrary file deletion vulnerability affecting MasterStudy LMS versions 3.7.42 and below. It allows an attacker to delete any file on the server without authentication.

Impact Analysis

An attacker could exploit this to delete critical files, disrupt services, or cause data loss. This could lead to system downtime, loss of important data, or even complete system compromise depending on which files are deleted.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized data deletion or system disruption. It may violate integrity and availability requirements under these regulations.

Mitigation Strategies

Update MasterStudy LMS to the latest version beyond 3.7.42 to patch the unauthenticated arbitrary file deletion vulnerability. If an update is not immediately available, consider disabling the affected plugin or restricting network access to the system until a patch is applied.

Hi! I’m here to help you understand CVE-2026-78284. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70