An authenticated attacker can submit a crafted POST request to the /adminapi/file/video_data_save endpoint of CRMEB v6.0.0, which causes the application to delete any file on the server without proper validation. The flaw is a CWE‑73 (Unauthorized File Deletion) vulnerability, allowing the attacker to remove critical system or application files, potentially leading to data loss, service disruption, or compromise of system integrity.

The vulnerability affects CRMEB software version 6.0.0. No other affected versions or vendors are listed in the data.

The flaw requires authentication but otherwise imposes no special prerequisites; once logged in, the attacker can trigger file deletion. The CVSS score of 7.2 indicates a high severity impact, and the EPSS score of <1% suggests a very low exploitation probability; yet the flaw remains critical because it allows removal of arbitrary files. The vulnerability is not included in CISA’s KEV catalog, indicating that there have been no known widespread exploits at the time of reporting.