CyberRota Analysis
AI-GeneratedOneNav v1.2.4 is vulnerable to an authenticated arbitrary file deletion flaw in the Api::upload() method, allowing authenticated administrators to delete files by submitting a crafted filename that matches an existing file in the application's working directory. This can lead to unintended file removal and potential denial of service. Organizations using this version should prioritize remediation to prevent misuse by compromised administrator accounts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controlled filename to unlink() when rejecting the upload, potentially causing file deletion and denial of service.