CVE-2026-31216

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/{object_name:path} endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send crafted requests with a user-controlled object_name path parameter to delete arbitrary files from the underlying MinIO storage system. Successful exploitation leads to data loss and denial of service.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ModelEngine-Group/nexent	Product
https://www.notion.so/CVE-2026-31216-35d1e139318881208297f0fbd8005f68	Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nexent:nexent:1.7.5.2:*:*:*:*:*:*:*

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El servicio de backend nexent v1.7.5.2 contiene una vulnerabilidad de eliminación arbitraria de archivos de almacenamiento no autorizada en su API de gestión de archivos. El endpoint DELETE /storage/{object_name:path} carece de mecanismos de autenticación, autorización y validación de entrada. Atacantes remotos no autenticados pueden enviar solicitudes manipuladas con un parámetro de ruta object_name controlado por el usuario para eliminar archivos arbitrarios del sistema de almacenamiento MinIO subyacente. La explotación exitosa conduce a la pérdida de datos y a la denegación de servicio.

Information

Published : 2026-05-12 16:16

Updated : 2026-10-19 22:10

NVD link : CVE-2026-31216

Mitre link : CVE-2026-31216

CVE.ORG link : CVE-2026-31216

JSON object : View

Products Affected

nexent

nexent

CWE

CWE-552

Files or Directories Accessible to External Parties

{"id": "CVE-2026-31216", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31216", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T13:59:40.650976Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-12T16:16:13.493", "references": [{"url": "https://github.com/ModelEngine-Group/nexent", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.notion.so/CVE-2026-31216-35d1e139318881208297f0fbd8005f68", "tags": ["Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-552"}]}], "descriptions": [{"lang": "en", "value": "The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/{object_name:path} endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send crafted requests with a user-controlled object_name path parameter to delete arbitrary files from the underlying MinIO storage system. Successful exploitation leads to data loss and denial of service."}, {"lang": "es", "value": "El servicio de backend nexent v1.7.5.2 contiene una vulnerabilidad de eliminaci\u00f3n arbitraria de archivos de almacenamiento no autorizada en su API de gesti\u00f3n de archivos. El endpoint DELETE /storage/{object_name:path} carece de mecanismos de autenticaci\u00f3n, autorizaci\u00f3n y validaci\u00f3n de entrada. Atacantes remotos no autenticados pueden enviar solicitudes manipuladas con un par\u00e1metro de ruta object_name controlado por el usuario para eliminar archivos arbitrarios del sistema de almacenamiento MinIO subyacente. La explotaci\u00f3n exitosa conduce a la p\u00e9rdida de datos y a la denegaci\u00f3n de servicio."}], "lastModified": "2026-10-19T22:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nexent:nexent:1.7.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1353C867-57F3-4921-A8EC-EA93A32CAC3D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}