A path traversal flaw exists in the POST /api/delete-file endpoint of DumbAssets 1.0.11. The filesToDelete array accepts "../" sequences that bypass directory boundary checks, enabling attackers to remove any file on the host system. By deleting critical files such as server.js or package.json, an attacker can render the application inoperable, resulting in denial of service.

This issue affects DumbWareio DumbAssets version 1.0.11 and any earlier releases. No other products or versions are currently known to be impacted.

The vulnerability carries a CVSS score of 8.8, indicating high severity, and the EPSS score is not available but the remote, unauthenticated nature of the API suggests that exploitation is feasible. The vulnerability is not yet listed in CISA's KEV catalog. Attackers can exploit the flaws by sending crafted POST requests to the vulnerable endpoint from any network location, without authentication, and achieving arbitrary file deletion.