Executive brief
OneNav is a PHP-based bookmark management application. The vulnerability allows an authenticated administrator to delete arbitrary files from the server by uploading a file with a crafted filename. An attacker with admin credentials can cause data loss or application disruption by targeting critical files in the application directory.
Technical details
The vulnerability exists in the Api::upload() method in class/Api.php, where user-supplied filenames are passed to PHP's unlink() function during upload validation. When a non-HTML file is submitted, the application rejects the upload but calls unlink() on the client-controlled filename before returning an error. If the filename matches an existing file in the application's working directory, it will be deleted instead of a temporary upload file. The attack requires authenticated administrator privileges and network access to the POST /index.php?c=api&method=upload endpoint. An attacker can exploit this to delete critical files like index.php, causing denial of service or data loss.
Affected products
- helloxz OneNav 1.2.4
Timeline
- 2026-09-15: disclosed: Vulnerability published on NVD