The nexent v1.7.5.2 backend service exposes an unauthenticated arbitrary file deletion vulnerability via its ElasticSearch DELETE /{index_name}/documents endpoint. Due to missing authentication and authorization controls and lack of validation on the path_or_url parameter, attackers can remotely send crafted requests to delete arbitrary documents in ElasticSearch indices and corresponding files stored in MinIO. This leads to data loss and service disruption. There is no known patch or vendor advisory detailing remediation at this time.

Successful exploitation allows unauthenticated remote attackers to delete arbitrary data from ElasticSearch indices and associated files in MinIO storage, causing data destruction and denial of service to the affected backend service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the vulnerable endpoint and implement compensating controls such as network-level authentication or firewall rules to prevent unauthorized access.