NoMachine Arbitrary File Deletion Vulnerability via External Control of File Path

An arbitrary file deletion vulnerability has been identified in NoMachine. This issue arises from improper validation of user-supplied paths in environment variables, allowing local attackers with low-privileged code execution to delete arbitrary files. Exploitation of this vulnerability could result in the deletion of files with root privileges.

Impact

Exploitation of this vulnerability allows for the arbitrary deletion of files, potentially leading to the removal of critical system or application files.

Remediation

Users can upgrade to NoMachine version 9.4.14 to address this vulnerability.