CVE-2026-45230

Deferred Deferred - Pending Action

Path Traversal in DumbAssets via Arbitrary File Deletion

Publication date: 2026-05-18

Last updated on: 2026-05-18

Assigner: VulnCheck

Description

DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-18

Last Modified

2026-05-18

Generated

2026-06-30

AI Q&A

2026-05-19

EPSS Evaluated

2026-06-28

NVD

CVE-2026-45230

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in DumbAssets through version 1.0.11 and involves a path traversal issue in the POST /api/delete-file endpoint and the filesToDelete array parameters.

It allows unauthenticated attackers to delete arbitrary files by using ../ sequences that bypass directory boundary validation.

Attackers can exploit an optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json.

This can cause a complete denial of service.

Impact Analysis

The vulnerability can lead to a complete denial of service by allowing attackers to delete critical files in the application.

Attackers can delete important files like server.js or package.json.
Since the vulnerability can be exploited without authentication, it poses a high risk.

This could disrupt the availability of the application and potentially cause significant operational impact.

Hi! I’m here to help you understand CVE-2026-45230. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70