CVE-2026-88621 Details

A vulnerability allowing authenticated arbitrary file deletion has been identified in OneNav version 1.2.4. The issue arises in the Api::upload() method within class/Api.php. An authenticated administrator can exploit this vulnerability by uploading a filename that matches an existing file in the application's working directory. The application then passes this user-controlled filename to the unlink() function to reject the upload, potentially leading to unauthorized file deletion and a denial-of-service condition.

It is recommended to remove the current file deletion process that uses client-supplied filenames. Instead, only delete verified temporary upload files, reject invalid extensions before performing file operations, and ensure that any saved file paths remain within their designated directories.