Executive brief
DumbAssets, an asset management application, contains a security flaw that allows anyone with network access to delete files from the server. By sending a specially crafted request, an attacker can bypass security boundaries to delete critical system files like application code or configuration files. This can lead to a complete shutdown of the service and loss of important data.
Technical details
A path traversal vulnerability exists in DumbAssets through version 1.0.11 within the POST /api/delete-file endpoint and the filesToDelete array parameter. The application uses path.join() on user-supplied input without verifying that the resulting path remains within the intended data directory. An unauthenticated attacker can exploit this by supplying '../' sequences to traverse the file system and delete any file the Node.js process has permissions to access, including critical files like server.js or package.json. This vulnerability is particularly severe because authentication is optional and disabled by default. A fix has been proposed in the project's repository to implement path normalization and boundary validation.
Affected products
- DumbWareio DumbAssets through 1.0.11
Timeline
- 2026-05-16: patched: Pull request submitted to fix the vulnerability
- 2026-05-18: advisory: Vulnerability disclosed by VulnCheck and NVD