---
id: CVE-2026-45230
title: DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-file
summary: >-
  DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST
  /api/delete-file endpoint and filesToDelete array parameters that allows
  unauthenticated attackers to delete arbitrary files by supplying ../ sequences
  that by…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: DumbWareio
product: DumbAssets
affected:
  - DumbAssets <= 1.0.11
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-05-18T21:25:10.963023Z'
published: '2026-05-18'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:03:44.282Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45230'
references:
  - url: 'https://github.com/DumbWareio/DumbAssets/pull/136'
  - url: >-
      https://www.vulncheck.com/advisories/dumbassets-path-traversal-file-deletion-via-api-delete-file
tags:
  - cve.org
epss: 0.00626
epssPercentile: 0.50283
ingestedAt: '2026-11-08T14:51:22.422Z'
---

## Overview

DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.

## Affected

- `DumbAssets <= 1.0.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.