CVE-2026-45230

🗓️ 18 May 2026 18:06:56Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 14 Views🌐 WEB

Path traversal in POST /api/delete-file allows unauthenticated deletion of critical files via filesToDelete.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-45230	18 May 202618:06	–	attackerkb
Circl	CVE-2026-45230	18 May 202619:03	–	circl
CNNVD	DumbAssets 路径遍历漏洞	18 May 202600:00	–	cnnvd
Cvelist	CVE-2026-45230 DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-file	18 May 202618:06	–	cvelist
EUVD	EUVD-2026-30790	18 May 202618:06	–	euvd
NVD	CVE-2026-45230	18 May 202618:17	–	nvd
Positive Technologies	PT-2026-41715	18 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-45230	5 Jun 202619:18	–	redhatcve
Vulnrichment	CVE-2026-45230 DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-file	18 May 202618:06	–	vulnrichment

Vulners

Node

dumbwareio dumbassetsRange0–1.0.11

[
  {
    "defaultStatus": "affected",
    "vendor": "DumbWareio",
    "product": "DumbAssets",
    "repo": "https://github.com/DumbWareio/DumbAssets",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "1.0.11"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/dumbassets-path-traversal-file-deletion-via-api-delete-file
github	www.github.com/DumbWareio/DumbAssets/pull/136

Parameter	Position	Path	Description	CWE
filesToDelete	request body	/api/delete-file	Path traversal via POST /api/delete-file allowing unauthenticated deletion of arbitrary files using ../ sequences in filesToDelete parameter	CWE-22

23 Jun 2026 16:16Current

5.9Medium risk

Vulners AI Score5.9

CVSS 48.8

CVSS 3.19.1

EPSS0.00626

SSVC

CWE-22