CVE-2026-88621

Name of the Vulnerable Software and Affected Versions OneNav version 1.2.4

Description An authenticated administrator can trigger an arbitrary file deletion by submitting a non-HTML upload filename that matches an existing file in the application's working directory. This occurs within the Api::upload() function located in class/Api.php, where the application passes the user-controlled filename to the unlink() function when rejecting the upload, which can lead to a denial of service.

Recommendations As a temporary workaround, restrict access to the Api::upload() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.