CVE-2026-36726

Vulnerability

An unrestricted file deletion vulnerability exists in BookCars versions up to and including v8.3. The vulnerability resides in the /api/delete-temp-license/{file} endpoint, where the file parameter is directly concatenated into a filesystem path without proper validation. This allows for directory traversal sequences to be injected.

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a crafted request to the /api/delete-temp-license/{file} endpoint. The attacker needs to supply a file parameter containing directory traversal sequences (e.g., ../../) to navigate the filesystem and delete arbitrary files. The vulnerability is present in the deleteTempLicense function within /backend/src/controllers/userController.ts [1].

Impact

Successful exploitation allows an unauthenticated attacker to delete arbitrary files from the server's filesystem. The scope of the impact depends on the privileges of the BookCars process, but could lead to denial of service or the removal of critical system files.

Mitigation

To mitigate this vulnerability, it is recommended to canonicalize and verify that resolved paths are within the intended temporary directory, reject directory-traversal patterns and absolute paths, validate filenames against a strict allowlist, implement proper access controls, and run the service with least privilege. A fixed version is not yet disclosed in the available references [1].