CVE Intelligence
Analysis AI-assisted

CVE-2026-45230: DumbAssets Path Traversal Leading to Arbitrary File Deletion

DumbAssets through version 1.0.11 has a path traversal flaw in its file deletion endpoint that can let unauthenticated attackers delete arbitrary files on the server. The record assigns a CVSS 3.1 base score of 9.1 (critical), and deleting files such as server.js or package.json could cause complete denial of service. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-45230 affects DumbAssets through version 1.0.11. The weakness is a path traversal issue (CWE-22) in the POST /api/delete-file endpoint and its filesToDelete array parameters. According to the record, the input validation does not hold the file operations inside the intended application directory.

The VulnCheck advisory is listed as a third-party source: VulnCheck advisory. A related issue-tracking reference is GitHub pull request 136.

Impact

  • The record describes arbitrary file deletion outside the application directory.
  • Deletion of critical files such as server.js or package.json is described as causing complete denial of service.
  • The record's CVSS 3.1 vector indicates no confidentiality impact, high integrity impact and high availability impact, with network access and no privileges or user interaction required.
  • The record's CVSS 4.0 score from VulnCheck is 8.8.

Affected products and versions

  • DumbWareio DumbAssets, versions 1.0.11 and earlier, as stated in the affected range of the record.
  • The record lists no fixed version.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.01004 (percentile 0.61991). The SSVC fields in the record show exploitation as none, automatable as yes and technical impact as partial.

Remediation and mitigation

  • No vendor fix or patched version is listed in the record. The absence of a listed fix does not confirm that none exists; check the upstream project and the references for updates.
  • Restrict network exposure of the DumbAssets service, especially for any instance reachable from untrusted networks.
  • The record states that authentication is optional and disabled by default. Enabling and enforcing authentication is a reasonable inference for reducing exposure, but its effectiveness against this issue is not confirmed by the sources.
  • Maintain current, tested backups of the application directory and its configuration so that deleted files can be restored.
  • Run the application under an account with the minimum filesystem permissions needed for its function.

Detection guidance

  • Monitor the application's access logs for unexpected requests to the delete-file endpoint, particularly from unknown sources.
  • Alert on unexpected deletions or missing files in the application directory, especially core files such as the main server script and package manifest.
  • Review whether authentication is enabled on instances exposed to the network.

Limitations of the available information

  • The record does not include a fixed version, vendor patch details or a detailed vendor advisory beyond the third-party references listed.
  • The GitHub pull request is listed as issue tracking; its content was not verified for this analysis.
  • The record's source status is Deferred, and the EPSS date field is 2026-10-13, so the scoring data may change.
  • Whether all deployment configurations are affected is unknown.

Frequently asked questions

Which versions of DumbAssets are affected by CVE-2026-45230?

The record lists DumbWareio DumbAssets versions 1.0.11 and earlier as affected. No fixed version is listed in the record.

Is CVE-2026-45230 known to be actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

What is the main risk of this vulnerability?

The record describes unauthenticated arbitrary file deletion outside the application directory, which could delete critical files and cause complete denial of service.

What can administrators do now?

Since no fix is listed, administrators can restrict network exposure, consider enabling authentication, keep tested backups and limit filesystem permissions for the application account.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.