{"id":"CVE-2026-45230","title":"DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-file","summary":"DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that by…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvssSource":"cna","cwe":["CWE-22"],"vendor":"DumbWareio","product":"DumbAssets","affected":["DumbAssets <= 1.0.11"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-05-18T21:25:10.963023Z"},"published":"2026-05-18","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:03:44.282Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45230","references":[{"url":"https://github.com/DumbWareio/DumbAssets/pull/136"},{"url":"https://www.vulncheck.com/advisories/dumbassets-path-traversal-file-deletion-via-api-delete-file"}],"tags":["cve.org"],"epss":0.00626,"epssPercentile":0.50283,"ingestedAt":"2026-11-08T14:51:22.422Z","slug":"CVE-2026-45230","body":"## Overview\n\nDumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.\n\n## Affected\n\n- `DumbAssets <= 1.0.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}