PingPong is a platform for teaching and learning with large language models (Key detail from CVE description). A flaw in its thread file endpoints allows an authenticated user to retrieve or delete files outside the intended authorization scope (Key detail from CVE description). This vulnerability could lead to retrieval or deletion of private files, including user‑uploaded files and model‑generated output files (Key detail from CVE description). The primary impact is unauthorized access and deletion of private data (Key detail from CVE description).

Affected systems are installations of comppolicylab PingPong (CPE: cpe:2.3:a:harvard:pingpong) with versions prior to 7.27.2 (Key detail from CVE description).

The CVSS score of 8.6 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation (Key detail from SCORES). The vulnerability requires authentication and permission to view or participate in at least one thread, categorizing it as an authenticated web application vulnerability (Key detail from CVE description). Based on the description, it is inferred that the attack vector is a web application endpoint accessed by an authenticated user. This risk is not recorded in the CISA KEV catalog (Key detail from SCORES).