CVE-2026-36726

Name of the Vulnerable Software and Affected Versions bookcars version 8.3

Description An arbitrary file deletion issue exists in the '/api/delete-temp-license/{file}' endpoint. Unauthenticated attackers can delete arbitrary files by providing directory traversal sequences in the {file} variable. Directory traversal is a technique that uses special characters to access files and directories outside the intended folder.

Recommendations Update bookcars to a version newer than 8.3. As a temporary workaround, restrict access to the '/api/delete-temp-license/{file}' endpoint.