DumbAssets Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in DumbAssets versions through 1.0.11. This vulnerability exists in the POST /api/delete-file endpoint, specifically within the filesToDelete array parameters. It allows unauthenticated attackers to delete arbitrary files by exploiting directory boundary validation. By supplying ../ sequences, attackers can traverse outside the intended application directory and delete critical files such as server.js or package.json, leading to a complete denial-of-service condition.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion, with potential deletion of critical application files leading to a complete denial-of-service condition.

Remediation

Users can update to the latest version of DumbAssets where this vulnerability has been addressed.