CVE-2026-88621

{"id": "CVE-2026-88621", "cveTags": [], "metrics": {}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-09-15T16:17:39.157", "references": [{"url": "https://github.com/helloxz/onenav", "source": "cve@mitre.org"}, {"url": "https://github.com/returnwrong/returnwrong-security-advisories/blob/main/CVE-2026-88621.md", "source": "cve@mitre.org"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controlled filename to unlink() when rejecting the upload, potentially causing file deletion and denial of service."}], "lastModified": "2026-09-15T16:17:39.157", "sourceIdentifier": "cve@mitre.org"}