CVE-2026-88621: OneNav vulnerability
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controlled filename to unlink() when rejecting the upload, potentially causing file deletion and denial of service.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OneNav administrator can exploit it. The issue is therefore relevant where administrator credentials or sessions could be obtained or misused.
What must an attacker do to trigger the deletion?
The attacker must submit an upload with a non-HTML filename that matches an existing file in the application's working directory. When the upload is rejected, the application passes that user-controlled filename to unlink().
What is the likely impact?
A matching file in the application's working directory may be deleted, which can cause denial of service. The provided information describes file deletion, not file upload or code execution.
How can administrators assess possible exposure or prior exploitation?
Review upload activity performed by administrator accounts and investigate unexpected missing files in the application's working directory. Pay particular attention to rejected non-HTML uploads whose filenames matched application files.