CVE-2026-36726 - An arbitrary file deletion vulnerability in the /api/delete-temp-license/{file} endpoint of bookcars v8.3 allows unauthenticated attackers to delete arbitrary files via supplying directory traversal sequences

Back Back to CVE browser

MEDIUM

An arbitrary file deletion vulnerability in the /api/delete-temp-license/{file} endpoint of bookcars v8.3 allows unauthenticated attackers to delete arbitrary files via supplying directory traversal sequences

Published Jun 9, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.69%

Description

An arbitrary file deletion vulnerability in the /api/delete-temp-license/{file} endpoint of bookcars v8.3 allows unauthenticated attackers to delete arbitrary files via supplying directory traversal sequences.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (1)

https://github.com/CC-T-454455/Vulnerabilities/tree/master/bookcars/vulnerability-11
exploit

Link	Providers	Tags
https://github.com/CC-T-454455/Vulnerabilities/tree/master/bookcars/vulnerability-11		exploit

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 9, 2026

Updated Jun 10, 2026

Reserved Apr 6, 2026

Link CVE-2026-36726

CISA Vulnrichment

Updated Jun 10, 2026

NVD

Status Deferred

Modified Jul 23, 2026

Link CVE-2026-36726

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-36726