CVE-2026-75464

HighCVSS 8.1

Published: 24/08/2026(UTC)Updated: 12/10/2026(UTC)Translated: 25/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

38th percentile - higher than 38% of all known CVEs

Summary

OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().

Risk Assessment

An authenticated attacker can delete arbitrary files on the server, potentially leading to data loss or system corruption.

Recommendation

Update OneNav to a version newer than 1.2.4 if available, and restrict access to the import_link function.

Other vulnerabilities in OneNav

CVE-2026-88621Low
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controlled filename to unlink() when rejecting the upload, potentially causing file deletion and denial of service.

Original NVD description (English source)

OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().

Vulnerability data from NVD (NIST) · CISA KEV · EPSS