Unauthenticated Path Traversal in DumbAssets File Deletion

DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

DumbAssets versions through 1.0.11 contain a critical path traversal vulnerability in the POST /api/delete-file endpoint that allows unauthenticated attackers to delete arbitrary files from the server. By injecting ../ sequences into the filesToDelete array parameter, attackers bypass directory boundary validation and escape the intended application directory. This is particularly dangerous because the application's optional authentication control is disabled by default, meaning no credentials are required to exploit it. Attackers can target critical application files like server.js or package.json, resulting in complete denial of service. Any organization running affected versions of DumbAssets—especially those exposed to untrusted networks—faces immediate risk of service disruption and potential data loss.

Casky's 331 mapped skills detect this attack pattern by analyzing request structures and file operation behaviors associated with MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery). Practitioners using Casky would identify suspicious POST requests to the /api/delete-file endpoint containing path traversal sequences, patterns of sequential parent directory traversal attempts (../ chains), and requests originating from external sources that lack proper authentication tokens. The platform's Claude-powered analysis would flag the dangerous combination of disabled authentication controls with file system operations, correlating this to CWE-22 path traversal patterns and highlighting the distinction between normal file deletions within the intended directory and attempts to traverse boundaries. Practitioners would see detection findings that isolate reconnaissance activities (identifying file locations) from exploitation attempts (executing the actual deletes), enabling rapid response before critical system files are compromised.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-45230.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-45230

Casky has 331 skills that investigate the attack patterns behind CVE-2026-45230. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn