This vulnerability allows local attackers to delete arbitrary files on NoMachine installations. The flaw lies in the handling of environment variables, where user-supplied paths are not properly validated before file operations. An attacker must first gain low‑privileged code execution on the target system to exploit the flaw, after which they can delete files with the privileges of that session, potentially including root‑level files.

All versions of NoMachine software are potentially affected as no specific affected versions were disclosed. The vulnerability applies to the NoMachine product, used for remote desktop access.

The CVSS base score is 7.1, indicating high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires low‑privileged code execution, the attack is primarily local. An attacker who manages to execute code can delete files with the same privileges, enabling disruption or further privilege escalation. The lack of a public exploit reduces immediate threat, but organizations should still treat it as a high‑risk local vulnerability.