Executive brief
NukeViet, an open-source content management system, contains a vulnerability in its comment management system. An authorized administrator can exploit this to delete critical system files, such as configuration files, by providing a specially crafted file path. This can lead to a complete service outage and force the application back into its initial installation state, potentially exposing sensitive setup wizards to the public.
Technical details
A path traversal vulnerability exists in NukeViet's 'modules/comment/admin/edit.php' due to insufficient validation of the 'attach' parameter. The application uses substr() to strip a fixed-length prefix from the input without verifying the resulting path, allowing an attacker to store traversal sequences (e.g., '../../config.php') in the database. When the associated comment is deleted, the 'del.php' script calls 'nv_deletefile()', which resolves the path via realpath() but only checks if the file is within the application root rather than the specific uploads directory. This allows an authenticated administrator to delete any file the web server has permissions to access. The issue is fixed in version 4.6.00 by implementing 'nv_is_file()' validation.
Affected products
- NukeViet NukeViet < 4.6.00
Timeline
- 2026-07-13: advisory: GitHub Advisory GHSA-c9xg-64p9-f2jj published
- 2026-07-13: patched: Fixed in version 4.6.00