CVE-2026-54065: NukeViet Path Traversal Vulnerability Leading to Arbitrary File Deletion
Summary
CVE-2026-54065: NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function. Affects nukeviet/nukeviet versions < 4.6.00. Fixed in 4.6.00. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NukeViet is an open-source content management system (CMS) designed for building websites and managing online content. It offers a range of features including user management, comment systems, and file uploads. However, a critical vulnerability exists in the Edit Comment function, which allows authenticated administrators to exploit the system through path traversal, leading to potential file deletions within the application root.
Vulnerability Detail
The vulnerability arises from inadequate validation of the 'attach' parameter in the Edit Comment admin function. An attacker can manipulate this parameter to perform path traversal, allowing them to delete arbitrary files, such as 'config.php', from the application root. This can lead to a complete application outage and expose sensitive installation files. The issue is rooted in the use of the 'substr()' function, which does not sufficiently restrict file deletions to the intended upload directory, thus enabling the deletion of any file within the NV_ROOTDIR.
How To Fix
Minimum fixed version
4.6.00
This is the first release that contains the fix.
composer require nukeviet/nukeviet:4.6.00Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Edit Comment function until the package is updated. Additionally, ensure that file permissions are set to restrict deletion of critical files by the web server process.
Conclusion
The NukeViet CMS has a critical path traversal vulnerability that allows authenticated administrators to delete arbitrary files, potentially leading to severe application outages. It is crucial to update to the latest version to mitigate this risk and ensure the integrity of your application.
See every vulnerability recorded for nukeviet/nukeviet →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Authenticated administrators of NukeViet installations are primarily affected, as they can exploit this vulnerability to delete critical files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Any file that is readable by the web server process within the NV_ROOTDIR can be permanently deleted, including critical files like 'config.php'.
If you cannot update the package right away, refrain from using the Edit Comment function and ensure proper file permissions to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for nukeviet/nukeviet.
