The backend service used by nexent v1.7.5.2 exposes an HTTP DELETE endpoint that removes files from a MinIO storage system without requiring any form of authentication or authorization, and without validating the path supplied by the caller. By sending a crafted request to this endpoint, an unauthenticated remote attacker can delete any file that the storage service exposes, effectively causing data loss and potentially disabling application functionality due to missing files.

The vulnerable component is the file management API of nexent version 1.7.5.2. No additional vendor or product information is listed, suggesting that this specific release is the only known affected environment at the time of reporting.

The attack vector is implied to be remote over the network, as the endpoint is publicly exposed and requires no credentials. Because the vulnerability is unauthenticated, any entity with network reach to the service can abuse it, making the exploitation likelihood high from the attacker's perspective. The Exploit Prediction Scoring System (EPSS) score is not provided, and the vulnerability is not listed in CISA’s KEV catalog, yet the lack of safeguards and the destructive nature of the flaw warrant treating it as a high‑severity exposure.