CVE-2026-88621

22th percentile - higher than 22% of all known CVEs

OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controlled filename to unlink() when rejecting the upload, potentially causing file deletion and denial of service.

An authenticated administrator can delete arbitrary files in the application's working directory, potentially leading to data loss or service unavailability. The risk is limited to administrative accounts but the impact can be severe.

Update OneNav to a version newer than 1.2.4 if available, or restrict administrative privileges and validate filenames before passing them to unlink(). Consider monitoring for unusual file deletion operations.