CVE-2026-75464

Received Received - Intake

Authenticated Arbitrary File Deletion in OneNav 1.2.4

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: MITRE

Description

OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-75464

EUVD

EUVD-2026-65146

Affected Vendors & Products

Vendor	Product	Version / Range
onenav	onenav	1.2.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

OneNav version 1.2.4 has an authenticated vulnerability where an attacker with access can delete arbitrary files on the system through the import_link() function.

Impact Analysis

An attacker could exploit this to delete critical files, disrupt services, or cause data loss if they gain authenticated access to the system.

Compliance Impact

This vulnerability could lead to unauthorized data deletion, potentially violating integrity and availability requirements in GDPR and HIPAA, depending on the affected files.

Mitigation Strategies

Upgrade OneNav to a version that is not affected by this vulnerability. If no patch is available, disable the import_link() functionality or restrict access to authenticated users with minimal privileges.

Hi! I’m here to help you understand CVE-2026-75464. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70