Executive Summary

This vulnerability exists in DumbAssets through version 1.0.11 and involves a path traversal issue in the POST /api/delete-file endpoint and the filesToDelete array parameters.

It allows unauthenticated attackers to delete arbitrary files by using ../ sequences that bypass directory boundary validation.

Attackers can exploit an optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json.

This can cause a complete denial of service.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a complete denial of service by allowing attackers to delete critical files in the application.

• Attackers can delete important files like server.js or package.json.
• Since the vulnerability can be exploited without authentication, it poses a high risk.

This could disrupt the availability of the application and potentially cause significant operational impact.

Useful 0 Not Useful 0