CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-45230 — DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /a...

·Source: NIST NVD

Updated:

Executive Summary

DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application

Analysis

DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service. CVSS Score: 9.1. Published: 2026-05-18T18:17:37.070.

Indicators of Compromise (1)

CVE (1)
CVE-2026-45230
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on May 18, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-8836 — A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_par...

A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to i

CVE-2026-8836
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-42822 — Improper authentication in Azure Local Disconnected Operations allows an unautho...

Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-42822
NIST NVD
MEDIUMVulnerability

Grafana refuses to pay ransom after codebase theft

On Saturday night, the company released a statement confirming the incident and outlining their decision not to pay a ransom issued by the hackers behind the attack.

The Record