CVE-2026-31216 — CRITICAL (9.1)

Vulnerability Description

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/{object_name:path} endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send crafted requests with a user-controlled object_name path parameter to delete arbitrary files from the underlying MinIO storage system. Successful exploitation leads to data loss and denial of service.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Nexent	Nexent	1.7.5.2

Related Weaknesses (CWE)

CWE-552

References

https://github.com/ModelEngine-Group/nexentProduct
https://www.notion.so/CVE-2026-31216-35d1e139318881208297f0fbd8005f68MitigationThird Party Advisory

FAQ

What is CVE-2026-31216?

CVE-2026-31216 is a vulnerability with a CVSS score of 9.1 (CRITICAL). The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/{object_name:path} endpoint lacks authenticat...

How severe is CVE-2026-31216?

CVE-2026-31216 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-31216?

Check the references section above for vendor advisories and patch information. Affected products include: Nexent Nexent.