Executive brief
OneNav is a web-based bookmark/link management application. Version 1.2.4 contains a vulnerability that allows authenticated administrators to delete arbitrary files on the server by manipulating file path parameters. An attacker with admin access could delete critical application files, causing service outages and data loss.
Technical details
The vulnerability is a path traversal vulnerability (CWE-73: External Control of File Name or Path) in the import_link() function within class/Api.php. The application accepts a user-supplied filename parameter during a file deletion operation but fails to properly canonicalize and validate the path, allowing traversal sequences (e.g., `../`) to escape the intended import directory. An authenticated administrator can craft a malicious POST request to `/index.php?c=api&method=import_link` with a traversal path to delete files outside the intended scope. No patch was available at publication; mitigation requires restricting administrative access and implementing proper path validation server-side.
Affected products
- helloxz OneNav 1.2.4
Timeline
- 2026-08-24: disclosed