CVE-2026-45230
CriticalSummary
DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint, allowing unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation.
Risk Assessment
Attackers can exploit this vulnerability to delete critical files such as server.js or package.json, leading to complete denial of service.
Recommendation
It is recommended to update to the latest version of DumbAssets and enable authentication controls to minimize the risk of unauthorized access.
Original NVD description (English source)
DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.