EUVD-2026-30790
GHSA-7x5q-37jc-hq6p
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionNVD
DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.
AnalysisAI
Arbitrary file deletion in DumbAssets through 1.0.11 lets unauthenticated remote attackers destroy any file the Node.js process can write to by submitting ../ sequences in the filesToDelete array of the POST /api/delete-file endpoint. Because authentication on the application is optional and disabled by default, exposed instances can be rendered completely non-functional by deleting critical files such as server.js or package.json. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Immediately restrict network access to all DumbAssets POST /api/delete-file endpoints via firewall or WAF rules; audit all deployments to identify versions 1.0.11 and earlier and verify authentication is enabled. Within 7 days: Implement Web Application Firewall rules blocking POST requests to /api/delete-file; deploy file integrity monitoring on application server directories; enforce mandatory authentication on all DumbAssets instances regardless of deployment configuration. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today