CVE-2026-45230
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A path traversal vulnerability in DumbAssets through version 1.0.11 in the POST /api/delete-file endpoint and filesToDelete array parameters allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.
Risk Assessment
The risk for the organization includes complete loss of application availability by deleting critical server files, potentially leading to downtime and the need to restore the environment from backup.
Recommendation
Immediately update DumbAssets to a version above 1.0.11 or apply a workaround by enabling and configuring authentication and adding server-side file path validation.
Original NVD description (English source)
DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.