# CVE-2026-54065: NukeViet path traversal in Edit Comment function

Source: https://junglewise.ai/threats/cve-2026-54065-nukeviet-path-traversal-in-edit-comment-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-54065 · Severity: high · CVSS 8.7 · Published 2026-07-13

NukeViet, an open-source content management system, contains a vulnerability in its comment management system. An authorized administrator can exploit this to delete critical system files, such as configuration files, by providing a specially crafted file path. This can lead to a complete service outage and force the application back into its initial installation state, potentially exposing sensitive setup wizards to the public.

Technologies: [NukeViet](https://junglewise.ai/threats/technologies/nukeviet), [nukeviet/nukeviet (Packagist)](https://junglewise.ai/threats/technologies/nukeviet-nukeviet). Vendors: [NukeViet](https://junglewise.ai/threats/vendors/nukeviet), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-54065 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54065 being exploited in the wild.

**How severe is CVE-2026-54065?** High severity, with a CVSS score of 8.7, published 13 July 2026.

**Which products and versions are affected?** NukeViet < 4.6.00; nukeviet/nukeviet (Packagist) < 4.6.00, ECOSYSTEM:introduced=0,fixed=4.6.00.

**Is there a fix for CVE-2026-54065?** Yes. nukeviet/nukeviet (Packagist): upgrade to 4.6.00 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54065 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-54065?** Check whether you run NukeViet or nukeviet/nukeviet (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nukeviet/nukeviet (Packagist): upgrade to 4.6.00 or later

  ```sh
  composer require nukeviet/nukeviet:^4.6.00
  ```


## Technical details

A path traversal vulnerability exists in NukeViet's 'modules/comment/admin/edit.php' due to insufficient validation of the 'attach' parameter. The application uses substr() to strip a fixed-length prefix from the input without verifying the resulting path, allowing an attacker to store traversal sequences (e.g., '../../config.php') in the database. When the associated comment is deleted, the 'del.php' script calls 'nv_deletefile()', which resolves the path via realpath() but only checks if the file is within the application root rather than the specific uploads directory. This allows an authenticated administrator to delete any file the web server has permissions to access. The issue is fixed in version 4.6.00 by implementing 'nv_is_file()' validation.

## Affected products

- NukeViet NukeViet < 4.6.00

## Identifiers

- CVE-2026-54065
- GHSA-c9xg-64p9-f2jj

## Timeline

- 2026-07-13: advisory: GitHub Advisory GHSA-c9xg-64p9-f2jj published
- 2026-07-13: patched: Fixed in version 4.6.00

## References

- [https://api.github.com/users/g03m0n](https://api.github.com/users/g03m0n)
- [https://github.com/g03m0n](https://github.com/g03m0n)
- [https://api.github.com/users/g03m0n/gists%7B/gist_id%7D](https://api.github.com/users/g03m0n/gists%7B/gist_id%7D)
- [https://api.github.com/users/g03m0n/repos](https://api.github.com/users/g03m0n/repos)
- [https://avatars.githubusercontent.com/u/130943529?v=4](https://avatars.githubusercontent.com/u/130943529?v=4)
- [https://api.github.com/users/g03m0n/events%7B/privacy%7D](https://api.github.com/users/g03m0n/events%7B/privacy%7D)

## Related threats

- [NukeViet SSRF via X-Forwarded-Host in server_info_update](https://junglewise.ai/threats/cve-2026-55372-nukeviet-ssrf-via-x-forwarded-host-in-server-info-update)
- [NukeViet stored XSS via filter bypass in News module](https://junglewise.ai/threats/cve-2026-54064-nukeviet-stored-xss-via-filter-bypass-in-news-module)
- [NukeViet CMS stored XSS in comment reply component](https://junglewise.ai/threats/cve-2026-49259-nukeviet-cms-stored-xss-in-comment-reply-component)
- [NukeViet reflected XSS in Comment Module](https://junglewise.ai/threats/cve-2026-48118-nukeviet-reflected-xss-in-comment-module)
- [NukeViet CMS Stored XSS in Request class](https://junglewise.ai/threats/cve-2026-41147-nukeviet-cms-stored-xss-in-request-class)