CVE-2026-7024

Vulnerability in rawchen/sims up to commit 004f783b1db5ecdfad81c8fdc3b34171211112de. The deleteFileServlet endpoint in sims-master/src/web/servlet/file/DeleteFileServlet.java lacks authentication and input validation. The filename parameter is directly concatenated into a file path without sanitization, enabling path traversal [1].

An unauthenticated attacker can send a crafted GET request to the filename parameter (e.g., ../aaaa.txt) to delete arbitrary files on the server. The attack is remotely exploitable and does not require any privileges [1].

Successful exploitation can lead to deletion of critical system files, potentially causing system paralysis, data loss, or complete service failure [1].

The vendor was contacted but did not respond. No patch is available; the product does not use versioning. The exploit has been published, increasing the risk of active exploitation [1].