CVE-2026-88621: OneNav v1.2.4 File Deletion DoS Vulnerability

CVE-2026-88621 Overview

CVE-2026-88621 is an authenticated arbitrary file deletion vulnerability in OneNav v1.2.4, an open-source bookmark management application. The flaw resides in the Api::upload() method within class/Api.php. An authenticated administrator can submit an upload request with a non-HTML filename that matches an existing file in the application's working directory. When the application rejects the upload, it passes the attacker-controlled filename directly to unlink(), deleting the targeted file. Successful exploitation can remove application data or configuration files and cause denial of service.

Critical Impact
Authenticated administrators can delete arbitrary files within the OneNav working directory, leading to data loss and application-level denial of service.

Affected Products

OneNav v1.2.4
class/Api.php component containing the Api::upload() method
Deployments exposing the OneNav administrative interface

Discovery Timeline

2026-09-15 - CVE CVE-2026-88621 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-88621

Vulnerability Analysis

The vulnerability exists in the file upload handler implemented by Api::upload() in class/Api.php. OneNav restricts uploads to HTML files. When a non-HTML file is submitted, the handler rejects the request and attempts to clean up by calling unlink() on the supplied filename. The application does not sanitize or validate that the filename refers only to the transient uploaded artifact. As a result, the cleanup routine operates on any path an authenticated administrator supplies, including existing files in the OneNav working directory. Removal of database files, configuration files, or bookmark data destabilizes the application and produces denial-of-service conditions.

Root Cause

The root cause is improper input validation of a user-controlled filename used in a filesystem operation. The rejection branch of Api::upload() trusts the request-supplied name and passes it to unlink() without confirming the target corresponds to a newly uploaded temporary file. This is a classic file system vulnerability where a privileged operation acts on unsanitized user input.

Attack Vector

Exploitation requires authenticated administrator access to the OneNav instance. The attacker issues an upload request through the administrative API, sets the filename parameter to match an existing file within the working directory, and uses a non-HTML extension to force the rejection path. The handler executes unlink() on the referenced file, removing it from disk. No memory corruption or code execution occurs; the primary impact is integrity loss and service disruption.

No verified proof-of-concept code is included in this article. For technical specifics, refer to the GitHub Security Advisory CVE-2026-88621 and the OneNav project repository.

Detection Methods for CVE-2026-88621

Indicators of Compromise

Web server or application logs showing authenticated POST requests to the OneNav upload endpoint with non-HTML file extensions.
Upload requests where the filename parameter references paths such as data/onenav.db3, configuration files, or other resources inside the OneNav working directory.
Unexpected disappearance of OneNav database, configuration, or bookmark files followed by application errors.

Detection Strategies

Inspect access logs for repeated upload attempts from a single administrator session that reference filenames outside the expected temporary upload namespace.
Correlate unlink() filesystem events on the OneNav host with HTTP requests to the upload API to identify abuse of the rejection branch.
Monitor administrator account behavior for anomalous file operations, especially from newly created or infrequently used accounts.

Monitoring Recommendations

Enable filesystem auditing on the OneNav working directory to capture delete operations and the process context that issued them.
Forward web server access logs and PHP error logs to a centralized logging platform for retention and query.
Alert on repeated administrative authentication failures followed by successful logins, which may indicate credential compromise preceding exploitation.

How to Mitigate CVE-2026-88621

Immediate Actions Required

Restrict network access to the OneNav administrative interface using firewall rules, IP allowlists, or a reverse proxy with authentication.
Rotate OneNav administrator credentials and enforce strong, unique passwords for every administrative account.
Back up the OneNav database and configuration files so that any deleted state can be restored quickly.

Patch Information

No vendor patch is referenced in the enriched CVE data at the time of writing. Monitor the OneNav project repository for a fixed release, and review the GitHub Security Advisory CVE-2026-88621 for remediation guidance from the reporter.

Workarounds

Limit administrative access to trusted operators only, and remove unused administrator accounts.
Run the OneNav process under a dedicated low-privilege user and restrict write and delete permissions on the working directory to the minimum required set.
Place OneNav behind a web application firewall rule that blocks upload requests whose filename parameter contains path separators or non-HTML extensions.

bash

# Example: restrict filesystem permissions for the OneNav working directory
# Adjust owner and group to match the PHP runtime user in your environment
chown -R onenav:onenav /var/www/onenav
find /var/www/onenav -type d -exec chmod 750 {} \;
find /var/www/onenav -type f -exec chmod 640 {} \;
# Keep a scheduled backup of the OneNav database
cp /var/www/onenav/data/onenav.db3 /var/backups/onenav/onenav.db3.$(date +%F)