CVE-2026-54065

Name of the Vulnerable Software and Affected Versions NukeViet (affected versions not specified)

Description An authenticated administrator can delete arbitrary files within the application root by exploiting a path traversal issue in the Edit Comment admin function. The issue occurs because the attach parameter in the modules/comment/admin/edit.php endpoint is not properly validated. By providing a crafted attach value consisting of padding characters followed by a path traversal sequence, an attacker can store a malicious path in the database. When the associated comment is deleted, the nv deletefile() function processes this path, allowing the deletion of any file readable by the web server within the installation root, such as config.php. This can lead to a full application outage and trigger the installation wizard.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the modules/comment/admin/edit.php endpoint to only the most trusted administrators.