What is the CVSS score of CVE-2026-36726?

CVE-2026-36726 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

bookcars CVE-2026-36726

MEDIUM

Path Traversal (CWE-22)

2026-06-09 mitre

Path Traversal N A

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:51 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An arbitrary file deletion vulnerability in the /api/delete-temp-license/{file} endpoint of bookcars v8.3 allows unauthenticated attackers to delete arbitrary files via supplying directory traversal sequences.

AnalysisAI

{file} endpoint, which fails to restrict path traversal sequences in the file parameter. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no privileges, and no user interaction from a network position. No public exploit identified at time of analysis, and the EPSS score of 0.12% (30th percentile) reflects low observed exploitation probability, though the no-auth attack surface warrants attention for publicly exposed deployments.

Technical ContextAI

bookcars is a car booking web application (v8.3). The vulnerable endpoint /api/delete-temp-license/{file} accepts a filename parameter used to reference and delete temporary license files on the server filesystem. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the application fails to canonicalize or validate the supplied file parameter before constructing a filesystem path, allowing sequences such as '../../' to escape the intended temporary directory and reference arbitrary files accessible to the web server process. CPE data in the NVD entry is listed as n/a, meaning automated asset-matching tooling will not reliably flag this against software inventories - affected version must be confirmed by manual inspection of the installed bookcars version.

RemediationAI

No vendor-released patch or advisory has been identified at time of analysis - the only reference is a third-party vulnerability disclosure on GitHub (https://github.com/CC-T-454455/Vulnerabilities/tree/master/bookcars/vulnerability-11). Until an official patch is released, operators should apply the following compensating controls: restrict network access to the /api/delete-temp-license/ endpoint via firewall or reverse proxy ACLs so it is not reachable from untrusted networks (trade-off: may break legitimate license upload/delete flows if the endpoint is user-facing); add server-side input validation to reject any file parameter containing traversal sequences ('..', '%2e%2e', encoded variants) and enforce that resolved paths remain within the designated temp directory using path canonicalization; and ensure the web server process runs under a least-privilege OS account with write access limited strictly to the temp license directory, reducing the blast radius of any successful exploitation. Monitor the bookcars project repository for an upstream fix.