CVE-2026-45230
Path Traversal in DumbAssets via Arbitrary File Deletion
Publication date: 2026-05-18
Last updated on: 2026-05-18
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in DumbAssets through version 1.0.11 and involves a path traversal issue in the POST /api/delete-file endpoint and the filesToDelete array parameters.
It allows unauthenticated attackers to delete arbitrary files by using ../ sequences that bypass directory boundary validation.
Attackers can exploit an optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json.
This can cause a complete denial of service.
How can this vulnerability impact me? :
The vulnerability can lead to a complete denial of service by allowing attackers to delete critical files in the application.
- Attackers can delete important files like server.js or package.json.
- Since the vulnerability can be exploited without authentication, it poses a high risk.
This could disrupt the availability of the application and potentially cause significant operational impact.