CVE-2026-36723

Vulnerability

An unrestricted file rename vulnerability exists in BookCars versions 8.3 and earlier at the /api/create-user endpoint. The vulnerability arises from the direct concatenation of user-supplied file and language fields into filesystem paths during file renaming operations without proper validation or canonicalization. This affects files such as /backend/src/routes/userRoutes.ts and /backend/src/controllers/userController.ts [1].

Exploitation

Authenticated attackers can exploit this vulnerability by leveraging directory traversal sequences within the file and language parameters of a request to the /api/create-user endpoint. This allows them to move arbitrary files from temporary storage to any location on the server's filesystem, provided the source and destination are on the same filesystem device [1].

Impact

Successful exploitation allows attackers to gain unauthorized access to sensitive files, overwrite critical application files, and potentially achieve remote code execution (RCE) by replacing dynamically imported JavaScript modules. The scope of the compromise is determined by the attacker's ability to write to arbitrary locations on the server filesystem [1].

Mitigation

Mitigations include validating and sanitizing path components, canonicalizing paths, rejecting inputs with directory traversal sequences or absolute paths, using server-generated filenames, implementing strict file extension whitelisting, and enforcing least-privilege filesystem permissions. A fixed version is not yet disclosed in the available references. Workarounds may include restricting access to the /api/create-user endpoint or ensuring that temporary storage and application directories are on different filesystem devices if not using Docker, or configuring Docker volumes appropriately [1].