CVE-2026-88621
Received Received - Intake

Authenticated Arbitrary File Deletion in OneNav

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: MITRE

Description
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controlled filename to unlink() when rejecting the upload, potentially causing file deletion and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-88621
EUVD
EUVD-2026-78864

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
returnwrong onenav 1.2.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OneNav v1.2.4 has an authenticated arbitrary file deletion vulnerability in the Api::upload() method. An authenticated administrator can submit a filename that matches an existing file in the application's directory. When the upload is rejected, the application uses this filename with the unlink() function, which can delete the file and cause a denial of service.

Detection Guidance

To detect this vulnerability, check for unauthorized file deletions in your OneNav v1.2.4 application directory. Review server logs for unlink() calls with user-controlled filenames. Look for suspicious upload attempts with non-HTML filenames matching existing files.

Impact Analysis

This vulnerability allows an authenticated attacker to delete critical files on the server, potentially disrupting services, corrupting data, or causing system instability. If important application files are deleted, the system may become unusable until restored.

Compliance Impact

This vulnerability could lead to data breaches or loss of sensitive information if critical files are deleted, violating GDPR's integrity and availability principles or HIPAA's requirements for safeguarding protected health information.

Mitigation Strategies

Immediately upgrade OneNav to a patched version beyond v1.2.4. If upgrading is not possible, restrict file upload permissions to prevent authenticated administrators from submitting filenames that could match existing files. Monitor file system changes and disable the upload feature if unused.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart