The backend service used by nexent v1.7.5.2 exposes an HTTP DELETE endpoint that removes files from a MinIO storage system without requiring any form of authentication or authorization, and without validating the path supplied by the caller. By sending a crafted request to this endpoint, an unauthenticated remote attacker can delete any file that the storage service exposes, effectively causing data loss and potentially disabling application functionality due to missing files.

The vulnerable component is the file management API of nexent version 1.7.5.2. No additional vendor or product information is listed, suggesting that this specific release is the only known affected environment at the time of reporting.

The attack vector is implied to be remote over the network, as the endpoint is publicly exposed and requires no credentials. Because the vulnerability is unauthenticated, any entity with network reach to the service can abuse it, making the exploitation likelihood high from the attacker's perspective. The CVSS score of 9.1 indicates severe impact, and the EPSS score shown as < 1% suggests a low overall probability of exploitation. Although the flaw is not recorded in CISA’s KEV catalog, the lack of safeguards combined with the destructive nature of the vulnerability warrants treating it as a high‑severity exposure.