Path Traversal Vulnerability in DumbAssets by DumbWareio

CVE-2026-45230

What is CVE-2026-45230?

DumbAssets versions up to 1.0.11 are vulnerable to a path traversal issue in the POST /api/delete-file endpoint. This vulnerability allows unauthenticated attackers to exploit the filesToDelete array parameters by injecting ../ sequences, thereby bypassing directory boundary validation. Such exploitation could lead to the deletion of critical server files, including server.js and package.json, and result in a complete denial of service for the affected application. The vulnerability also allows attackers to bypass optional authentication controls that are disabled by default, increasing the potential risk of exploitation.

References