CVE-2026-31216 - Vulnerability Analysis

Overview

Nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability caused by lack of authentication, authorization, and input validation in DELETE /storage/{object_name:path} endpoint, letting unauthenticated remote attackers delete arbitrary files, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can delete arbitrary files, causing data loss and denial of service.

Mitigation

Update to the latest version with proper authentication, authorization, and input validation on DELETE /storage/{object_name:path} endpoint.

References

• https://github.com/ModelEngine-Group/nexent
• https://www.notion.so/CVE-2026-31216-35d1e139318881208297f0fbd8005f68

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner