CVE-2026-45230: Critical Path Traversal in DumbAssets Allows Arbitrary File Deletion

The National Vulnerability Database has issued a critical advisory for CVE-2026-45230, a path traversal vulnerability in DumbAssets through version 1.0.11. This flaw exists within the POST /api/delete-file endpoint and its filesToDelete array parameters. Unauthenticated attackers can exploit this by injecting ../ sequences, bypassing directory boundary validation and allowing the deletion of arbitrary files.

The impact is severe: attackers can traverse outside the intended application directory to delete critical server files like server.js or package.json. This leads to a complete denial of service. While authentication is an optional, disabled-by-default control, its default state leaves installations wide open to this destructive attack. The CVSSv3 score of 9.1 (CRITICAL) underscores the ease of exploitation and the devastating consequences.

This isn’t just a theoretical vulnerability; it’s a direct path to application shutdown. Organizations using DumbAssets must understand that the default configuration is highly insecure. Attackers are constantly looking for low-hanging fruit with high impact, and an unauthenticated arbitrary file deletion fits that profile perfectly. The calculus for an attacker here is simple: find an exposed instance, send a crafted request, and take the system offline. Defenders need to act decisively.