CVE-2026-36726: bookcars Path Traversal Vulnerability

CVE-2026-36726 Overview

CVE-2026-36726 is an arbitrary file deletion vulnerability in bookcars v8.3. The flaw exists in the /api/delete-temp-license/{file} API endpoint. Unauthenticated attackers can supply directory traversal sequences in the {file} parameter to delete arbitrary files on the host system. The weakness is classified as Path Traversal [CWE-22]. Because the endpoint requires no authentication, any network-reachable attacker can issue requests against vulnerable deployments. Successful exploitation can remove configuration files, runtime artifacts, or other application data, leading to integrity loss and service disruption.

Critical Impact
Unauthenticated remote attackers can delete arbitrary files on the server, affecting application integrity and availability.

Affected Products

bookcars v8.3
Earlier bookcars releases exposing the /api/delete-temp-license/{file} endpoint
Deployments that expose the bookcars API to untrusted networks

Discovery Timeline

2026-06-09 - CVE-2026-36726 published to the National Vulnerability Database
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-36726

Vulnerability Analysis

The vulnerability resides in the bookcars REST API route /api/delete-temp-license/{file}. The endpoint accepts a filename through the URL path and passes it to a file deletion routine without canonicalization or allowlist validation. Attackers can encode directory traversal sequences such as ../ to escape the intended temporary license directory. The handler then resolves the path relative to the application working directory and removes the targeted file. No authentication is required to invoke the endpoint, expanding the population of potential attackers to anyone with network access. The Exploit Prediction Scoring System rates this issue with a probability of 0.589% and a percentile of 69.6 as of 2026-06-11.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The endpoint trusts user-supplied input for filesystem operations. It does not normalize the path, reject traversal sequences, or constrain operations to the temporary license directory. The handler also lacks authentication and authorization controls, removing a key compensating layer.

Attack Vector

An attacker sends an HTTP DELETE or GET request to /api/delete-temp-license/ with a crafted value such as ..%2F..%2Fetc%2Fpasswd or ../../config/.env. The server resolves the relative path, identifies the target file, and removes it. The attack requires no credentials, no user interaction, and only network reachability to the bookcars API. Technical details and a proof-of-concept walkthrough are available in the GitHub Vulnerability Repository.

Detection Methods for CVE-2026-36726

Indicators of Compromise

HTTP requests to /api/delete-temp-license/ containing ../, ..\, or URL-encoded variants such as %2e%2e%2f
Unexpected deletion of configuration files, environment files, or assets outside the temporary license directory
Application errors or crashes after file removal events correlated with API access logs

Detection Strategies

Inspect web server and reverse proxy logs for requests to the delete-temp-license route with traversal patterns
Deploy web application firewall signatures that match path traversal payloads on this endpoint
Enable filesystem auditing on directories used by bookcars to capture unauthorized delete operations

Monitoring Recommendations

Forward bookcars application and proxy logs to a centralized analytics platform for correlation
Alert on file deletions originating from the bookcars service account outside its expected working paths
Track baseline request volume to /api/delete-temp-license/ and alert on anomalies

How to Mitigate CVE-2026-36726

Immediate Actions Required

Restrict network access to the bookcars API to trusted clients using firewall or reverse proxy rules
Block requests to /api/delete-temp-license/ containing traversal sequences at the WAF or proxy layer
Audit the filesystem for unauthorized deletions and restore affected files from backups

Patch Information

No vendor patch is referenced in the NVD record at the time of publication. Monitor the bookcars project repository and upstream advisories for fixed releases. Apply updates that enforce path canonicalization and authentication on the affected endpoint as soon as they become available.

Workarounds

Disable or remove the /api/delete-temp-license/{file} route until a patched version is deployed
Enforce authentication and role-based authorization on the endpoint through middleware or an API gateway
Validate the {file} parameter against an allowlist of expected filenames and reject any input containing path separators or traversal sequences

bash

# Configuration example: block traversal requests at an Nginx reverse proxy
location ~* ^/api/delete-temp-license/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    proxy_pass http://bookcars_backend;
}