A missing path validation check in the Worktree.remove component of openCode v1.18.26 allows attackers to craft a payload specifying any directory path. When the function processes the payload, it performs a recursive delete on the supplied path, resulting in data loss and potential service disruption. This flaw arises from an input validation failure and permits destructive file system operations without authorization.

The affected product is the openCode framework version 1.18.26. No additional vendor or product information is supplied by the CNA data.

The vulnerability can be triggered by sending a crafted request to the Worktree.remove endpoint. If the endpoint is exposed to external users, remote exploitation is possible; the description implies that local access may also suffice, but the exact attack vector is inferred from the typical use of this component and is not explicitly stated in the CVE data. The CVSS score of 9.1 reflects the high impact of arbitrary deletion, while the EPSS score of less than 1% indicates a low probability of exploitation in current field samples. The issue is not listed in the CISA KEV catalog, further confirming that no widespread, actively exploited instances are known. Nonetheless, because the flaw allows deletion of any directory specified by the attacker, the potential loss and integrity damage is significant and requires prompt action when the affected version is in use.