CVE-2026-31215

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-31215

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31215.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-31215

Published

2026-05-12T00:00:00Z

Modified

2026-08-12T03:51:15.506923281Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

[none]

Details

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface. The DELETE /{indexname}/documents endpoint lacks proper authentication and authorization controls and does not validate the user-supplied pathor_url parameter. This allows unauthenticated remote attackers to send crafted requests that trigger the deletion of arbitrary documents from ElasticSearch indices and corresponding files from the MinIO storage system. Successful exploitation leads to data destruction and denial of service.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31215.json"
}

References

Affected packages

Git / github.com/modelengine-group/nexent

Affected ranges

Type

GIT

Repo

https://github.com/modelengine-group/nexent

Events

Introduced

747761fe44d3f00b2d0c37d8b9ae2134789d276e

Last affected

747761fe44d3f00b2d0c37d8b9ae2134789d276e

Database specific

Show details

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:nexent:nexent:1.7.5.2:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.7.5.2"
        },
        {
            "last_affected": "1.7.5.2"
        }
    ]
}

Affected versions

1.*

1.7.5.2

v1.*

v1.7.5.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31215.json"