EUVD-2026-29500
GHSA-v7m4-rwp4-vmrq
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/{object_name:path} endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send crafted requests with a user-controlled object_name path parameter to delete arbitrary files from the underlying MinIO storage system. Successful exploitation leads to data loss and denial of service.
AnalysisAI
{object_name:path} API lacks authentication, authorization, and input validation (CWE-552). CVSS 9.1 reflects critical severity, though EPSS score of 0.08% (23rd percentile) and SSVC 'exploitation: none' indicate no observed active exploitation or public exploit code at time of analysis. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
{object_name:path} API to authorized sources only; apply any available vendor update or security patch if released. Within 30 days: upgrade to patched Nexent version when available; conduct forensic audit of MinIO deletion logs and restore critical data from backups; implement API authentication and rate-limiting on all storage endpoints.
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today