Executive brief
BookCars, a vehicle rental management system, contains a security flaw that allows anyone on the internet to delete files from the server. By sending a specially crafted web request, an attacker can bypass security restrictions to remove critical system files or application data. This could lead to a total loss of service, data corruption, or the disabling of security features.
Technical details
An arbitrary file deletion vulnerability exists in BookCars <= v8.3 due to improper input validation in the /api/delete-temp-license/{file} endpoint. The application uses path.join() to concatenate a user-provided filename with a temporary directory path without sanitizing directory traversal sequences (e.g., '../'). An unauthenticated remote attacker can exploit this by sending a POST request containing URL-encoded traversal characters to delete any file the application process has permissions to access. The vulnerability is located in the deleteTempLicense controller within /backend/src/controllers/userController.ts. No official patch is confirmed, but mitigations include implementing path canonicalization and validating that the resolved path remains within the intended directory.
Affected products
- BookCars BookCars <= v8.3
Timeline
- 2026-06-09: disclosed: Initial disclosure and NVD publication