PerfreeBlog version 4.0.11 is vulnerable to an arbitrary file deletion flaw that could allow an attacker to disrupt system operations.

The application contains an arbitrary file deletion vulnerability in the unInstallTheme function. The CVSS vector indicates that this vulnerability is reachable by an unauthenticated attacker, though it requires user interaction.

Successful exploitation of this vulnerability can lead to unauthorized deletion of critical system files, potentially resulting in service outages or the destruction of essential application data. With a CVSS score of 7.6, this flaw is categorized as High severity, posing a significant risk to the availability and integrity of the blog platform.

Immediate Action: Since a specific patch is currently unknown, administrators should restrict access to the administrative theme management interface and monitor the environment for unauthorized file system modifications.

Proactive Monitoring: Review web server and application logs for suspicious access patterns directed at the theme management endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests targeting the unInstallTheme function or suspicious file path manipulation attempts.

Public Exploit Available: Yes — a public proof-of-concept is documented in the security researcher's write-up referenced in the CVE data.

Given the High severity of this vulnerability and the availability of a published proof-of-concept, administrators must prioritize securing the affected system. Until an official vendor patch is released, ensure the administrative interface is not exposed to the public internet and verify that file system permissions are configured to follow the principle of least privilege.